Vercel rolls out new protection against stolen session cookie attacks

Vercel is gradually rolling out Device Bound Session Credentials (DBSC) on its platform as a key defense against information stealer malware.

The new feature, announced by Vercel's CTO Malte Ubl on X, binds a login session to the user's device with a private key stored in a TPM, so even if the session cookie is stolen, it can't be reused on another device.

Vercel is a cloud platform developers use to deploy and host websites, web applications, and AI agents. The company also develops the popular Next.js web framework.

Its latest announcement concerns logins to Vercel's platform at vercel.com, where developers manage their projects and deployments.

"DBSC works by storing a private key in your device's TPM (the same device that the fingerprint sensor or similar biometric devices on your laptop or phone uses) and using that key to sign your cookie," explained Ubl.