Device Bound Session Credentials (DBSC) is an experimental web standard implemented in ASP.NET Core that ties session cookies to a device's private key, preventing cookie replay attacks. When a stolen cookie is copied to another machine, it becomes useless for session refresh since only the original device can sign the cryptographic challenge. This significantly reduces the attack window from weeks to minutes by forcing short-lived cookies that require device-based proof to refresh.