diff --git a/index.html b/index.html
deleted file mode 100644
index 137b30c..0000000
--- a/index.html
+++ /dev/null
@@ -1,68 +0,0 @@
-<!doctype html>
-<html lang="en">
-
-<head>
- <meta charset="utf-8">
- <title>Device Bound Session Credentials</title>
- <script src="https://www.w3.org/Tools/respec/respec-w3c" class="remove"></script>
- <script class='remove'>
- "use strict";
- // See https://github.com/w3c/respec/wiki/ for how to configure ReSpec
- var respecConfig = {
- "githubAPI": "WICG/dbsc",
- "editors": [{
- name: "Kristian Monsen",
- email: "kristianm@google.com",
- company: "Google",
- companyURL: "https://google.com",
- },
- // Add additional editors here.
- // https://github.com/w3c/respec/wiki/editors
- ],
- "shortName": "dbsc",
- "specStatus": "CG-DRAFT",
- "wg": "WICG",
- };
- </script>
-</head>
-
-<body>
- <section id="abstract">
- <p>
- This specification does neat stuff.
- </p>
- </section>
- <section id="sotd">
- <p>
- This is an unofficial proposal.
- </p>
- </section>
- <section id="introduction">
- <h2>Introduction</h2>
- <p>
- See <a href="https://github.com/w3c/respec/wiki/User's-Guide">ReSpec's
- user guide</a> for how to get started!
- </p>
- </section>
- <section data-dfn-for="Foo">
- <h2>Start your spec!</h2>
- <pre class="idl">
- interface Foo {
- attribute Bar bar;
- void doTheFoo();
- };
- </pre>
- <p>
- See <a href="https://github.com/w3c/respec/wiki/WebIDL-Guide">ReSpec's
- WebIDL guide</a> for how to write [[!WebIDL-2]] interfaces!
- </p>
- <p>
- The <dfn>doTheFoo</dfn> method.
- </p>
- <p>
- The <dfn>bar</dfn> attribute.
- </p>
- </section>
-</body>
-
-</html>
diff --git a/key_registration.svg b/key_registration.svg
deleted file mode 100644
index 2ce7b9e..0000000
--- a/key_registration.svg
+++ /dev/null
@@ -1 +0,0 @@
-<?xml version="1.0" encoding="utf-8" standalone="no"?><!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 20010904//EN" "http://www.w3.org/TR/2001/REC-SVG-20010904/DTD/svg10.dtd"><svg xmlns="http://www.w3.org/2000/svg" width="779" height="594" xmlns:xlink="http://www.w3.org/1999/xlink"><desc style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">Created with Raphaël 2.2.0</desc><defs style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"><path stroke-linecap="round" d="M5,0 0,2.5 5,5z" id="raphael-marker-block" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></path><marker id="raphael-marker-endblock55-objiyxm7" markerHeight="5" markerWidth="5" orient="auto" refX="2.5" refY="2.5" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"><use xlink:href="#raphael-marker-block" transform="rotate(180 2.5 2.5) scale(1,1)" stroke-width="1.0000" fill="#000" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></use></marker><marker id="raphael-marker-endblock55-obj58qq9" markerHeight="5" markerWidth="5" orient="auto" refX="2.5" refY="2.5" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"><use xlink:href="#raphael-marker-block" transform="rotate(180 2.5 2.5) scale(1,1)" stroke-width="1.0000" fill="#000" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></use></marker><marker id="raphael-marker-endblock55-objb07l8" markerHeight="5" markerWidth="5" orient="auto" refX="2.5" refY="2.5" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"><use xlink:href="#raphael-marker-block" transform="rotate(180 2.5 2.5) scale(1,1)" stroke-width="1.0000" fill="blue" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></use></marker><marker id="raphael-marker-endblock55-objgvc1j" markerHeight="5" markerWidth="5" orient="auto" refX="2.5" refY="2.5" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"><use xlink:href="#raphael-marker-block" transform="rotate(180 2.5 2.5) scale(1,1)" stroke-width="1.0000" fill="#000" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></use></marker><marker id="raphael-marker-endblock55-objmzp3v" markerHeight="5" markerWidth="5" orient="auto" refX="2.5" refY="2.5" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"><use xlink:href="#raphael-marker-block" transform="rotate(180 2.5 2.5) scale(1,1)" stroke-width="1.0000" fill="#000" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></use></marker><marker id="raphael-marker-endblock55-objptm77" markerHeight="5" markerWidth="5" orient="auto" refX="2.5" refY="2.5" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"><use xlink:href="#raphael-marker-block" transform="rotate(180 2.5 2.5) scale(1,1)" stroke-width="1.0000" fill="blue" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></use></marker></defs><rect x="10" y="10" width="115.08854675292969" height="27.33333396911621" rx="0" ry="0" fill="none" stroke="#000000" stroke-width="2" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><rect x="15.330729484558105" y="15" width="105.08854675292969" height="17.33333396911621" rx="0" ry="0" fill="#ffffff" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><text x="67.54427337646484" y="23.666666984558105" text-anchor="middle" font-family="Roboto" font-size="16px" stroke="none" fill="#000000" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); text-anchor: middle; font-family: Roboto; font-size: 16px;"><tspan dy="5.3333330154418945" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">Session creation</tspan></text><rect x="46.33464050292969" y="47.33333396911621" width="74.8828125" height="37.33333396911621" rx="0" ry="0" fill="#ffffff" stroke="#0000ff" stroke-width="2" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><rect x="56.66667938232422" y="57.333335876464844" width="54.8828125" height="17.33333396911621" rx="0" ry="0" fill="#ffffff" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><text x="83.77604675292969" y="66.00000095367432" text-anchor="middle" font-family="Roboto" font-size="16px" stroke="none" fill="#000000" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); text-anchor: middle; font-family: Roboto; font-size: 16px;"><tspan dy="5.333333969116211" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">Browser</tspan></text><rect x="46.33464050292969" y="537.2000102996826" width="74.8828125" height="37.33333396911621" rx="0" ry="0" fill="#ffffff" stroke="#0000ff" stroke-width="2" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><rect x="56.66667938232422" y="547.2000122070312" width="54.8828125" height="17.33333396911621" rx="0" ry="0" fill="#ffffff" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><text x="83.77604675292969" y="555.8666772842407" text-anchor="middle" font-family="Roboto" font-size="16px" stroke="none" fill="#000000" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); text-anchor: middle; font-family: Roboto; font-size: 16px;"><tspan dy="5.333311080932617" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">Browser</tspan></text><path fill="none" stroke="#000000" d="M83.77604675292969,84.66666793823242L83.77604675292969,537.2000102996826" stroke-width="2" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></path><rect x="400.89975357055664" y="47.33333396911621" width="79.35677337646484" height="37.33333396911621" rx="0" ry="0" fill="#ffffff" stroke="#ff0000" stroke-width="2" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><rect x="411.015625" y="57.333335876464844" width="59.356773376464844" height="17.33333396911621" rx="0" ry="0" fill="#ffffff" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><text x="440.57814025878906" y="66.00000095367432" text-anchor="middle" font-family="Roboto" font-size="16px" stroke="none" fill="#000000" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); text-anchor: middle; font-family: Roboto; font-size: 16px;"><tspan dy="5.333333969116211" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">Webpage</tspan></text><rect x="400.89975357055664" y="537.2000102996826" width="79.35677337646484" height="37.33333396911621" rx="0" ry="0" fill="#ffffff" stroke="#ff0000" stroke-width="2" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><rect x="411.015625" y="547.2000122070312" width="59.356773376464844" height="17.33333396911621" rx="0" ry="0" fill="#ffffff" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><text x="440.57814025878906" y="555.8666772842407" text-anchor="middle" font-family="Roboto" font-size="16px" stroke="none" fill="#000000" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); text-anchor: middle; font-family: Roboto; font-size: 16px;"><tspan dy="5.333311080932617" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">Webpage</tspan></text><path fill="none" stroke="#000000" d="M440.57814025878906,84.66666793823242L440.57814025878906,537.2000102996826" stroke-width="2" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></path><rect x="562.8997650146484" y="47.33333396911621" width="62.4296875" height="37.33333396911621" rx="0" ry="0" fill="#0000ff" stroke="#000000" stroke-width="2" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><rect x="573.2344360351562" y="57.333335876464844" width="42.4296875" height="17.33333396911621" rx="0" ry="0" fill="#0000ff" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><text x="594.1146087646484" y="66.00000095367432" text-anchor="middle" font-family="Roboto" font-size="16px" stroke="none" fill="#ffffff" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); text-anchor: middle; font-family: Roboto; font-size: 16px;"><tspan dy="5.333333969116211" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">Server</tspan></text><rect x="562.8997650146484" y="537.2000102996826" width="62.4296875" height="37.33333396911621" rx="0" ry="0" fill="#0000ff" stroke="#000000" stroke-width="2" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><rect x="573.2344360351562" y="547.2000122070312" width="42.4296875" height="17.33333396911621" rx="0" ry="0" fill="#0000ff" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><text x="594.1146087646484" y="555.8666772842407" text-anchor="middle" font-family="Roboto" font-size="16px" stroke="none" fill="#ffffff" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); text-anchor: middle; font-family: Roboto; font-size: 16px;"><tspan dy="5.333311080932617" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">Server</tspan></text><path fill="none" stroke="#000000" d="M594.1146087646484,84.66666793823242L594.1146087646484,537.2000102996826" stroke-width="2" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></path><rect x="298.72137451171875" y="101" width="80.890625" height="17.33333396911621" rx="0" ry="0" fill="#ffffff" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><text x="338.94532775878906" y="109.66666793823242" text-anchor="middle" font-family="Roboto" font-size="16px" stroke="none" fill="#000000" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); text-anchor: middle; font-family: Roboto; font-size: 16px;"><tspan dy="5.333329200744629" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">Sign-in flow</tspan></text><path fill="none" stroke="#000000" d="M83.77604675292969,122.00000190734863C83.77604675292969,122.00000190734863,536.2960352003975,122.00000190734863,589.104764320976,122.00000190734863" stroke-width="2" marker-end="url(#raphael-marker-endblock55-objiyxm7)" stroke-dasharray="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></path><rect x="450.69012451171875" y="138.33334350585938" width="133.53646850585938" height="17.33333396911621" rx="0" ry="0" fill="#ffffff" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><text x="517.3463745117188" y="147.00000190734863" text-anchor="middle" font-family="Roboto" font-size="16px" stroke="none" fill="#000000" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); text-anchor: middle; font-family: Roboto; font-size: 16px;"><tspan dy="5.333334922790527" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">Sign-in success page</tspan></text><path fill="none" stroke="#000000" d="M594.1146087646484,159.33333587646484C594.1146087646484,159.33333587646484,471.9934277440425,159.33333587646484,445.577566810386,159.33333587646484" stroke-width="2" marker-end="url(#raphael-marker-endblock55-obj58qq9)" stroke-dasharray="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></path><rect x="163.7604217529297" y="175.6666717529297" width="196.171875" height="17.33333396911621" rx="0" ry="0" fill="#ffffff" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><text x="262.1770935058594" y="184.33333587646484" text-anchor="middle" font-family="Roboto" font-size="16px" stroke="none" fill="#000000" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); text-anchor: middle; font-family: Roboto; font-size: 16px;"><tspan dy="5.333325386047363" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">navigator.secureSession.start()</tspan></text><path fill="none" stroke="#0000ff" d="M440.57814025878906,196.66666984558105C440.57814025878906,196.66666984558105,132.02537474691962,196.66666984558105,88.78580262684807,196.66666984558105" stroke-width="2" marker-end="url(#raphael-marker-endblock55-objb07l8)" stroke-dasharray="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></path><rect x="25.361984252929688" y="216.66666984558105" width="116.828125" height="27.33333396911621" rx="0" ry="0" fill="none" stroke="#000000" stroke-width="2" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><rect x="30.697927474975586" y="221.6666717529297" width="106.828125" height="17.33333396911621" rx="0" ry="0" fill="#ffffff" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><text x="83.77604675292969" y="230.33333683013916" text-anchor="middle" font-family="Roboto" font-size="16px" stroke="none" fill="#000000" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); text-anchor: middle; font-family: Roboto; font-size: 16px;"><tspan dy="5.33332633972168" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">generate keypair</tspan></text><rect x="232.6484375" y="260.3333435058594" width="213.2526092529297" height="17.33333396911621" rx="0" ry="0" fill="#ffffff" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><text x="338.94532775878906" y="269.00000381469727" text-anchor="middle" font-family="Roboto" font-size="16px" stroke="none" fill="#000000" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); text-anchor: middle; font-family: Roboto; font-size: 16px;"><tspan dy="5.33333683013916" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">POST /securesession/startsession</tspan></text><path fill="none" stroke="#000000" d="M83.77604675292969,281.3333377838135C83.77604675292969,281.3333377838135,536.2960352003975,281.3333377838135,589.104764320976,281.3333377838135" stroke-width="2" marker-end="url(#raphael-marker-endblock55-objgvc1j)" stroke-dasharray="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></path><rect x="103.77604675292969" y="301.3333377838135" width="316.8020935058594" height="27.33333396911621" rx="0" ry="0" fill="none" stroke="#000000" stroke-width="2" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><rect x="108.77604675292969" y="306.3333435058594" width="306.8020935058594" height="17.33333396911621" rx="0" ry="0" fill="#ffffff" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><text x="262.1770935058594" y="315.0000047683716" text-anchor="middle" font-family="Roboto" font-size="16px" stroke="none" fill="#000000" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); text-anchor: middle; font-family: Roboto; font-size: 16px;"><tspan dy="5.333337783813477" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">{"binding_alg":..., "binding_public_key":..., ...}</tspan></text><rect x="479.7578353881836" y="348.6666717529297" width="228.7135467529297" height="27.33333396911621" rx="0" ry="0" fill="none" stroke="#000000" stroke-width="2" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><rect x="485.088623046875" y="353.66668701171875" width="218.7135467529297" height="17.33333396911621" rx="0" ry="0" fill="#ffffff" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><text x="594.1146087646484" y="362.3333387374878" text-anchor="middle" font-family="Roboto" font-size="16px" stroke="none" fill="#000000" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); text-anchor: middle; font-family: Roboto; font-size: 16px;"><tspan dy="5.3333282470703125" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">Store public key, establish session</tspan></text><rect x="259.62762451171875" y="382.73333740234375" width="158.86459350585938" height="36.533355712890625" rx="0" ry="0" fill="#ffffff" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><text x="338.94532775878906" y="401.0000057220459" text-anchor="middle" font-family="Roboto" font-size="16px" stroke="none" fill="#000000" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); text-anchor: middle; font-family: Roboto; font-size: 16px;"><tspan dy="-4.266672134399414" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">Set-Cookie: auth_cookie</tspan><tspan dy="19.2" x="338.94532775878906" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">{"session_identifier":...}</tspan></text><path fill="none" stroke="#000000" d="M594.1146087646484,432.5333423614502C594.1146087646484,432.5333423614502,141.59462031718067,432.5333423614502,88.78589119660217,432.5333423614502" stroke-width="2" marker-end="url(#raphael-marker-endblock55-objmzp3v)" stroke-dasharray="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></path><rect x="10" y="452.5333423614502" width="147.55209350585938" height="27.33333396911621" rx="0" ry="0" fill="none" stroke="#000000" stroke-width="2" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><rect x="15.114593505859375" y="457.5333251953125" width="137.55209350585938" height="17.33333396911621" rx="0" ry="0" fill="#ffffff" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><text x="83.77604675292969" y="466.2000093460083" text-anchor="middle" font-family="Roboto" font-size="16px" stroke="none" fill="#000000" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); text-anchor: middle; font-family: Roboto; font-size: 16px;"><tspan dy="5.33329963684082" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">Session is now active</tspan></text><rect x="175.5260467529297" y="496.20001220703125" width="172.6354217529297" height="17.33333396911621" rx="0" ry="0" fill="#ffffff" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><text x="262.1770935058594" y="504.8666763305664" text-anchor="middle" font-family="Roboto" font-size="16px" stroke="none" fill="#000000" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); text-anchor: middle; font-family: Roboto; font-size: 16px;"><tspan dy="5.333340644836426" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">promise.resolve(sessionId)</tspan></text><path fill="none" stroke="#0000ff" d="M83.77604675292969,517.2000102996826C83.77604675292969,517.2000102996826,392.3288122647991,517.2000102996826,435.5683843848707,517.2000102996826" stroke-width="2" marker-end="url(#raphael-marker-endblock55-objptm77)" stroke-dasharray="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></path></svg>
\ No newline at end of file
diff --git a/key_registration_header.svg b/key_registration_header.svg
deleted file mode 100644
index 260de2d..0000000
--- a/key_registration_header.svg
+++ /dev/null
@@ -1 +0,0 @@
-<?xml version="1.0" encoding="utf-8" standalone="no"?><!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 20010904//EN" "http://www.w3.org/TR/2001/REC-SVG-20010904/DTD/svg10.dtd"><svg xmlns="http://www.w3.org/2000/svg" width="885" height="557" xmlns:xlink="http://www.w3.org/1999/xlink"><desc style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">Created with Raphaël 2.2.0</desc><defs style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"><path stroke-linecap="round" d="M5,0 0,2.5 5,5z" id="raphael-marker-block" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></path><marker id="raphael-marker-endblock55-objve3to" markerHeight="5" markerWidth="5" orient="auto" refX="2.5" refY="2.5" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"><use xlink:href="#raphael-marker-block" transform="rotate(180 2.5 2.5) scale(1,1)" stroke-width="1.0000" fill="#000" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></use></marker><marker id="raphael-marker-endblock55-objnjzur" markerHeight="5" markerWidth="5" orient="auto" refX="2.5" refY="2.5" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"><use xlink:href="#raphael-marker-block" transform="rotate(180 2.5 2.5) scale(1,1)" stroke-width="1.0000" fill="#000" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></use></marker><marker id="raphael-marker-endblock55-obj3l2hh" markerHeight="5" markerWidth="5" orient="auto" refX="2.5" refY="2.5" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"><use xlink:href="#raphael-marker-block" transform="rotate(180 2.5 2.5) scale(1,1)" stroke-width="1.0000" fill="#000" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></use></marker><marker id="raphael-marker-endblock55-objln8ku" markerHeight="5" markerWidth="5" orient="auto" refX="2.5" refY="2.5" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"><use xlink:href="#raphael-marker-block" transform="rotate(180 2.5 2.5) scale(1,1)" stroke-width="1.0000" fill="#000" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></use></marker></defs><rect x="10" y="10" width="128.2421875" height="29" rx="0" ry="0" fill="none" stroke="#000000" stroke-width="2" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><rect x="15" y="15" width="118.2421875" height="19" rx="0" ry="0" fill="#ffffff" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><text x="74.12109375" y="24.5" text-anchor="middle" font-family="Roboto" font-size="16px" stroke="none" fill="#000000" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); text-anchor: middle; font-family: Roboto; font-size: 16px;"><tspan dy="5.5" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">Session creation</tspan></text><rect x="10" y="49" width="90.546875" height="39" rx="0" ry="0" fill="#ffffff" stroke="#ff0000" stroke-width="2" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><rect x="20" y="59" width="70.546875" height="19" rx="0" ry="0" fill="#ffffff" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><text x="55.2734375" y="68.5" text-anchor="middle" font-family="Roboto" font-size="16px" stroke="none" fill="#000000" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); text-anchor: middle; font-family: Roboto; font-size: 16px;"><tspan dy="5.5" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">Web page</tspan></text><rect x="10" y="498.4000015258789" width="90.546875" height="39" rx="0" ry="0" fill="#ffffff" stroke="#ff0000" stroke-width="2" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><rect x="20" y="508.4000244140625" width="70.546875" height="19" rx="0" ry="0" fill="#ffffff" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><text x="55.2734375" y="517.9000015258789" text-anchor="middle" font-family="Roboto" font-size="16px" stroke="none" fill="#000000" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); text-anchor: middle; font-family: Roboto; font-size: 16px;"><tspan dy="5.499977111816406" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">Web page</tspan></text><path fill="none" stroke="#000000" d="M55.2734375,88L55.2734375,498.4000015258789" stroke-width="2" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></path><rect x="237.6328125" y="49" width="78.546875" height="39" rx="0" ry="0" fill="#ffffff" stroke="#0000ff" stroke-width="2" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><rect x="247.6328125" y="59" width="58.546875" height="19" rx="0" ry="0" fill="#ffffff" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><text x="276.90625" y="68.5" text-anchor="middle" font-family="Roboto" font-size="16px" stroke="none" fill="#000000" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); text-anchor: middle; font-family: Roboto; font-size: 16px;"><tspan dy="5.5" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">Browser</tspan></text><rect x="237.6328125" y="498.4000015258789" width="78.546875" height="39" rx="0" ry="0" fill="#ffffff" stroke="#0000ff" stroke-width="2" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><rect x="247.6328125" y="508.4000244140625" width="58.546875" height="19" rx="0" ry="0" fill="#ffffff" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><text x="276.90625" y="517.9000015258789" text-anchor="middle" font-family="Roboto" font-size="16px" stroke="none" fill="#000000" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); text-anchor: middle; font-family: Roboto; font-size: 16px;"><tspan dy="5.499977111816406" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">Browser</tspan></text><path fill="none" stroke="#000000" d="M276.90625,88L276.90625,498.4000015258789" stroke-width="2" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></path><rect x="547.28515625" y="49" width="171.9921875" height="39" rx="0" ry="0" fill="#0000ff" stroke="#000000" stroke-width="2" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><rect x="557.28515625" y="59" width="151.9921875" height="19" rx="0" ry="0" fill="#0000ff" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><text x="633.28125" y="68.5" text-anchor="middle" font-family="Roboto" font-size="16px" stroke="none" fill="#ffffff" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); text-anchor: middle; font-family: Roboto; font-size: 16px;"><tspan dy="5.5" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">Registration endpoint</tspan></text><rect x="547.28515625" y="498.4000015258789" width="171.9921875" height="39" rx="0" ry="0" fill="#0000ff" stroke="#000000" stroke-width="2" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><rect x="557.28515625" y="508.4000244140625" width="151.9921875" height="19" rx="0" ry="0" fill="#0000ff" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><text x="633.28125" y="517.9000015258789" text-anchor="middle" font-family="Roboto" font-size="16px" stroke="none" fill="#ffffff" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); text-anchor: middle; font-family: Roboto; font-size: 16px;"><tspan dy="5.499977111816406" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">Registration endpoint</tspan></text><path fill="none" stroke="#000000" d="M633.28125,88L633.28125,498.4000015258789" stroke-width="2" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></path><rect x="136.97265625" y="103.5" width="58.234375" height="19" rx="0" ry="0" fill="#ffffff" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><text x="166.08984375" y="113" text-anchor="middle" font-family="Roboto" font-size="16px" stroke="none" fill="#000000" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); text-anchor: middle; font-family: Roboto; font-size: 16px;"><tspan dy="5.5" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">Request</tspan></text><path fill="none" stroke="#000000" d="M276.90625,127C276.90625,127,93.11204021982849,127,60.266004682942366,127" stroke-width="2" marker-end="url(#raphael-marker-endblock55-objve3to)" stroke-dasharray="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></path><rect x="65.2734375" y="132.89999389648438" width="201.6328125" height="38.20001220703125" rx="0" ry="0" fill="#ffffff" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><text x="166.08984375" y="152" text-anchor="middle" font-family="Roboto" font-size="16px" stroke="none" fill="#000000" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); text-anchor: middle; font-family: Roboto; font-size: 16px;"><tspan dy="-4.099998474121094" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">Response page with header</tspan><tspan dy="19.2" x="166.08984375" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"> Sec-Session-Registration: ...</tspan></text><path fill="none" stroke="#000000" d="M55.2734375,185.20000076293945C55.2734375,185.20000076293945,239.0676472801715,185.20000076293945,271.91368281705763,185.20000076293945" stroke-width="2" marker-end="url(#raphael-marker-endblock55-objnjzur)" stroke-dasharray="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></path><rect x="213.30859375" y="205.20000076293945" width="127.1953125" height="29" rx="0" ry="0" fill="none" stroke="#000000" stroke-width="2" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><rect x="218.30859375" y="210.1999969482422" width="117.1953125" height="19" rx="0" ry="0" fill="#ffffff" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><text x="276.90625" y="219.70000076293945" text-anchor="middle" font-family="Roboto" font-size="16px" stroke="none" fill="#000000" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); text-anchor: middle; font-family: Roboto; font-size: 16px;"><tspan dy="5.500003814697266" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">generate keypair</tspan></text><rect x="331.01171875" y="249.70001220703125" width="248.1640625" height="19" rx="0" ry="0" fill="#ffffff" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><text x="455.09375" y="259.20000076293945" text-anchor="middle" font-family="Roboto" font-size="16px" stroke="none" fill="#000000" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); text-anchor: middle; font-family: Roboto; font-size: 16px;"><tspan dy="5.499988555908203" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">POST /securesession/startsession</tspan></text><path fill="none" stroke="#000000" d="M276.90625,273.20000076293945C276.90625,273.20000076293945,585.0896766409278,273.20000076293945,628.2774908235187,273.20000076293945" stroke-width="2" marker-end="url(#raphael-marker-endblock55-obj3l2hh)" stroke-dasharray="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></path><rect x="296.90625" y="293.20000076293945" width="316.375" height="29" rx="0" ry="0" fill="none" stroke="#000000" stroke-width="2" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><rect x="301.90625" y="298.20001220703125" width="306.375" height="19" rx="0" ry="0" fill="#ffffff" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><text x="455.09375" y="307.70000076293945" text-anchor="middle" font-family="Roboto" font-size="16px" stroke="none" fill="#000000" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); text-anchor: middle; font-family: Roboto; font-size: 16px;"><tspan dy="5.499988555908203" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">{"binding_alg":..., "binding_public_key":..., ...}</tspan></text><rect x="507.21875" y="342.20000076293945" width="252.125" height="29" rx="0" ry="0" fill="none" stroke="#000000" stroke-width="2" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><rect x="512.21875" y="347.20001220703125" width="242.125" height="19" rx="0" ry="0" fill="#ffffff" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><text x="633.28125" y="356.70000076293945" text-anchor="middle" font-family="Roboto" font-size="16px" stroke="none" fill="#000000" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); text-anchor: middle; font-family: Roboto; font-size: 16px;"><tspan dy="5.499988555908203" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">Store public key, establish session</tspan></text><rect x="369.828125" y="377.1000061035156" width="170.53125" height="38.199981689453125" rx="0" ry="0" fill="#ffffff" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><text x="455.09375" y="396.20000076293945" text-anchor="middle" font-family="Roboto" font-size="16px" stroke="none" fill="#000000" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); text-anchor: middle; font-family: Roboto; font-size: 16px;"><tspan dy="-4.100017547607422" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">Set-Cookie: auth_cookie</tspan><tspan dy="19.2" x="455.09375" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">{"session_identifier":...}</tspan></text><path fill="none" stroke="#000000" d="M633.28125,429.4000015258789C633.28125,429.4000015258789,325.0978233590722,429.4000015258789,281.91000917648125,429.4000015258789" stroke-width="2" marker-end="url(#raphael-marker-endblock55-objln8ku)" stroke-dasharray="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></path><rect x="195.54296875" y="449.4000015258789" width="162.7265625" height="29" rx="0" ry="0" fill="none" stroke="#000000" stroke-width="2" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><rect x="200.54296875" y="454.3999938964844" width="152.7265625" height="19" rx="0" ry="0" fill="#ffffff" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><text x="276.90625" y="463.9000015258789" text-anchor="middle" font-family="Roboto" font-size="16px" stroke="none" fill="#000000" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); text-anchor: middle; font-family: Roboto; font-size: 16px;"><tspan dy="5.500007629394531" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">Session is now active</tspan></text></svg>
\ No newline at end of file
diff --git a/refresh.png b/refresh.png
deleted file mode 100644
index 993ac28..0000000
Binary files a/refresh.png and /dev/null differ
diff --git a/refresh_diagram.svg b/refresh_diagram.svg
deleted file mode 100644
index 282a4d1..0000000
--- a/refresh_diagram.svg
+++ /dev/null
@@ -1 +0,0 @@
-<?xml version="1.0" encoding="utf-8" standalone="no"?><!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 20010904//EN" "http://www.w3.org/TR/2001/REC-SVG-20010904/DTD/svg10.dtd"><svg xmlns="http://www.w3.org/2000/svg" width="505" height="661" xmlns:xlink="http://www.w3.org/1999/xlink"><desc style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">Created with Raphaël 2.2.0</desc><defs style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"><path stroke-linecap="round" d="M5,0 0,2.5 5,5z" id="raphael-marker-block" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></path><marker id="raphael-marker-endblock55-objm6eog" markerHeight="5" markerWidth="5" orient="auto" refX="2.5" refY="2.5" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"><use xlink:href="#raphael-marker-block" transform="rotate(180 2.5 2.5) scale(1,1)" stroke-width="1.0000" fill="#000" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></use></marker><marker id="raphael-marker-endblock55-obj1n4ri" markerHeight="5" markerWidth="5" orient="auto" refX="2.5" refY="2.5" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"><use xlink:href="#raphael-marker-block" transform="rotate(180 2.5 2.5) scale(1,1)" stroke-width="1.0000" fill="#000" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></use></marker><marker id="raphael-marker-endblock55-objywo5s" markerHeight="5" markerWidth="5" orient="auto" refX="2.5" refY="2.5" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"><use xlink:href="#raphael-marker-block" transform="rotate(180 2.5 2.5) scale(1,1)" stroke-width="1.0000" fill="#000" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></use></marker><marker id="raphael-marker-endblock55-objt834z" markerHeight="5" markerWidth="5" orient="auto" refX="2.5" refY="2.5" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"><use xlink:href="#raphael-marker-block" transform="rotate(180 2.5 2.5) scale(1,1)" stroke-width="1.0000" fill="green" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></use></marker><marker id="raphael-marker-endblock55-obj1j7qh" markerHeight="5" markerWidth="5" orient="auto" refX="2.5" refY="2.5" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"><use xlink:href="#raphael-marker-block" transform="rotate(180 2.5 2.5) scale(1,1)" stroke-width="1.0000" fill="green" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></use></marker><marker id="raphael-marker-endblock55-objmdzrx" markerHeight="5" markerWidth="5" orient="auto" refX="2.5" refY="2.5" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"><use xlink:href="#raphael-marker-block" transform="rotate(180 2.5 2.5) scale(1,1)" stroke-width="1.0000" fill="#000" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></use></marker><marker id="raphael-marker-endblock55-objnmlpq" markerHeight="5" markerWidth="5" orient="auto" refX="2.5" refY="2.5" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"><use xlink:href="#raphael-marker-block" transform="rotate(180 2.5 2.5) scale(1,1)" stroke-width="1.0000" fill="#000" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></use></marker><marker id="raphael-marker-endblock55-obj5okxg" markerHeight="5" markerWidth="5" orient="auto" refX="2.5" refY="2.5" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"><use xlink:href="#raphael-marker-block" transform="rotate(180 2.5 2.5) scale(1,1)" stroke-width="1.0000" fill="#000" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></use></marker></defs><rect x="78.52734375" y="20" width="74.8828125" height="37.33333396911621" rx="0" ry="0" fill="#0000ff" stroke="#000000" stroke-width="2" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><rect x="88.859375" y="30" width="54.8828125" height="17.33333396911621" rx="0" ry="0" fill="#0000ff" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><text x="115.96875" y="38.666666984558105" text-anchor="middle" font-family="Roboto" font-size="16px" stroke="none" fill="#ffffff" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); text-anchor: middle; font-family: Roboto; font-size: 16px;"><tspan dy="5.333332061767578" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">Browser</tspan></text><rect x="78.52734375" y="603.7333469390869" width="74.8828125" height="37.33333396911621" rx="0" ry="0" fill="#0000ff" stroke="#000000" stroke-width="2" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><rect x="88.859375" y="613.7333984375" width="54.8828125" height="17.33333396911621" rx="0" ry="0" fill="#0000ff" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><text x="115.96875" y="622.400013923645" text-anchor="middle" font-family="Roboto" font-size="16px" stroke="none" fill="#ffffff" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); text-anchor: middle; font-family: Roboto; font-size: 16px;"><tspan dy="5.333322525024414" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">Browser</tspan></text><path fill="none" stroke="#000000" d="M115.96875,57.33333396911621L115.96875,603.7333469390869" stroke-width="2" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></path><rect x="413.06903076171875" y="20" width="62.4296875" height="37.33333396911621" rx="0" ry="0" fill="none" stroke="#000000" stroke-width="2" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><rect x="423.4036560058594" y="30" width="42.4296875" height="17.33333396911621" rx="0" ry="0" fill="#ffffff" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><text x="444.28387451171875" y="38.666666984558105" text-anchor="middle" font-family="Roboto" font-size="16px" stroke="none" fill="#000000" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); text-anchor: middle; font-family: Roboto; font-size: 16px;"><tspan dy="5.333332061767578" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">Server</tspan></text><rect x="413.06903076171875" y="603.7333469390869" width="62.4296875" height="37.33333396911621" rx="0" ry="0" fill="none" stroke="#000000" stroke-width="2" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><rect x="423.4036560058594" y="613.7333984375" width="42.4296875" height="17.33333396911621" rx="0" ry="0" fill="#ffffff" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><text x="444.28387451171875" y="622.400013923645" text-anchor="middle" font-family="Roboto" font-size="16px" stroke="none" fill="#000000" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); text-anchor: middle; font-family: Roboto; font-size: 16px;"><tspan dy="5.333322525024414" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">Server</tspan></text><path fill="none" stroke="#000000" d="M444.28387451171875,57.33333396911621L444.28387451171875,603.7333469390869" stroke-width="2" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></path><rect x="43.87239074707031" y="77.33333396911621" width="144.19271850585938" height="27.33333396911621" rx="0" ry="0" fill="none" stroke="#000000" stroke-width="2" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><rect x="48.86979293823242" y="82.33333587646484" width="134.19271850585938" height="17.33333396911621" rx="0" ry="0" fill="#ffffff" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><text x="115.96875" y="91.00000095367432" text-anchor="middle" font-family="Roboto" font-size="16px" stroke="none" fill="#000000" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); text-anchor: middle; font-family: Roboto; font-size: 16px;"><tspan dy="5.333333969116211" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">while cookie is valid</tspan></text><rect x="228.58984375" y="121" width="102.40625" height="17.33333396911621" rx="0" ry="0" fill="#ffffff" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><text x="280.1263122558594" y="129.66666793823242" text-anchor="middle" font-family="Roboto" font-size="16px" stroke="none" fill="#000000" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); text-anchor: middle; font-family: Roboto; font-size: 16px;"><tspan dy="5.333329200744629" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">regular requests</tspan></text><path fill="none" stroke="#000000" d="M115.96875,142.00000190734863C115.96875,142.00000190734863,398.1006464926286,142.00000190734863,439.29080130283165,142.00000190734863" stroke-width="2" marker-end="url(#raphael-marker-endblock55-objm6eog)" stroke-dasharray="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></path><rect x="223.69921875" y="158.33334350585938" width="112.1875" height="17.33333396911621" rx="0" ry="0" fill="#ffffff" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><text x="280.1263122558594" y="167.00000190734863" text-anchor="middle" font-family="Roboto" font-size="16px" stroke="none" fill="#000000" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); text-anchor: middle; font-family: Roboto; font-size: 16px;"><tspan dy="5.333334922790527" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">regular responses</tspan></text><path fill="none" stroke="#000000" d="M444.28387451171875,179.33333587646484C444.28387451171875,179.33333587646484,162.15197801909017,179.33333587646484,120.96182320888707,179.33333587646484" stroke-width="2" marker-end="url(#raphael-marker-endblock55-obj1n4ri)" stroke-dasharray="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></path><rect x="30.203125" y="199.33333587646484" width="171.53125" height="46.5333366394043" rx="0" ry="0" fill="none" stroke="#000000" stroke-width="2" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><rect x="34.86979293823242" y="204.33334350585938" width="161.53125" height="36.53334045410156" rx="0" ry="0" fill="#ffffff" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><text x="115.96875" y="222.600004196167" text-anchor="middle" font-family="Roboto" font-size="16px" stroke="none" fill="#000000" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); text-anchor: middle; font-family: Roboto; font-size: 16px;"><tspan dy="-4.266679763793945" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">cookie expired,</tspan><tspan dy="19.2" x="115.96875" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">browser holding requests</tspan></text><rect x="227.9127655029297" y="262.20001220703125" width="104.41927337646484" height="17.33333396911621" rx="0" ry="0" fill="#ffffff" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><text x="280.1263122558594" y="270.86667251586914" text-anchor="middle" font-family="Roboto" font-size="16px" stroke="none" fill="#000000" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); text-anchor: middle; font-family: Roboto; font-size: 16px;"><tspan dy="5.33333683013916" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">/refresh_session</tspan></text><path fill="none" stroke="#000000" d="M115.96875,283.20000648498535C115.96875,283.20000648498535,398.1006464926286,283.20000648498535,439.29080130283165,283.20000648498535" stroke-width="2" marker-end="url(#raphael-marker-endblock55-objywo5s)" stroke-dasharray="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></path><rect x="135.96875" y="303.20000648498535" width="288.31512451171875" height="27.33333396911621" rx="0" ry="0" fill="#ffffff" stroke="#008000" stroke-width="2" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><rect x="141.29818725585938" y="308.20001220703125" width="278.31512451171875" height="17.33333396911621" rx="0" ry="0" fill="#ffffff" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><text x="280.1263122558594" y="316.86667346954346" text-anchor="middle" font-family="Roboto" font-size="16px" stroke="none" fill="#000000" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); text-anchor: middle; font-family: Roboto; font-size: 16px;"><tspan dy="5.333337783813477" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">challenge is optional, and can be precached</tspan></text><rect x="249.4752655029297" y="346.8666687011719" width="61.528648376464844" height="17.33333396911621" rx="0" ry="0" fill="#ffffff" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><text x="280.1263122558594" y="355.53334045410156" text-anchor="middle" font-family="Roboto" font-size="16px" stroke="none" fill="#000000" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); text-anchor: middle; font-family: Roboto; font-size: 16px;"><tspan dy="5.333348274230957" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">challenge</tspan></text><path fill="none" stroke="#008000" d="M444.28387451171875,367.8666744232178C444.28387451171875,367.8666744232178,162.15197801909017,367.8666744232178,120.96182320888707,367.8666744232178" stroke-width="2" marker-end="url(#raphael-marker-endblock55-objt834z)" stroke-dasharray="6,2" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></path><rect x="219.48568725585938" y="384.20001220703125" width="121.51302337646484" height="17.33333396911621" rx="0" ry="0" fill="#ffffff" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><text x="280.1263122558594" y="392.8666744232178" text-anchor="middle" font-family="Roboto" font-size="16px" stroke="none" fill="#000000" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); text-anchor: middle; font-family: Roboto; font-size: 16px;"><tspan dy="5.333338737487793" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">challenge response</tspan></text><path fill="none" stroke="#008000" d="M115.96875,405.200008392334C115.96875,405.200008392334,398.1006464926286,405.200008392334,439.29080130283165,405.200008392334" stroke-width="2" marker-end="url(#raphael-marker-endblock55-obj1j7qh)" stroke-dasharray="6,2" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></path><rect x="144.1471405029297" y="421.5333251953125" width="271.9583435058594" height="17.33333396911621" rx="0" ry="0" fill="#ffffff" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><text x="280.1263122558594" y="430.200008392334" text-anchor="middle" font-family="Roboto" font-size="16px" stroke="none" fill="#000000" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); text-anchor: middle; font-family: Roboto; font-size: 16px;"><tspan dy="5.333298683166504" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">Set-Cookie: auth_cookie, new instructions</tspan></text><path fill="none" stroke="#000000" d="M444.28387451171875,442.5333423614502C444.28387451171875,442.5333423614502,162.15197801909017,442.5333423614502,120.96182320888707,442.5333423614502" stroke-width="2" marker-end="url(#raphael-marker-endblock55-objmdzrx)" stroke-dasharray="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></path><rect x="10" y="462.5333423614502" width="211.9375" height="46.5333366394043" rx="0" ry="0" fill="none" stroke="#000000" stroke-width="2" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><rect x="14.666666984558105" y="467.5333251953125" width="201.9375" height="36.53338623046875" rx="0" ry="0" fill="#ffffff" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><text x="115.96875" y="485.80001068115234" text-anchor="middle" font-family="Roboto" font-size="16px" stroke="none" fill="#000000" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); text-anchor: middle; font-family: Roboto; font-size: 16px;"><tspan dy="-4.266670227050781" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">cookie refreshed,</tspan><tspan dy="19.2" x="115.96875" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">browser releasing held requests</tspan></text><rect x="240.5846405029297" y="525.4000244140625" width="78.63802337646484" height="17.33333396911621" rx="0" ry="0" fill="#ffffff" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><text x="280.1263122558594" y="534.0666790008545" text-anchor="middle" font-family="Roboto" font-size="16px" stroke="none" fill="#000000" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); text-anchor: middle; font-family: Roboto; font-size: 16px;"><tspan dy="5.333361625671387" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">held request</tspan></text><path fill="none" stroke="#000000" d="M115.96875,546.4000129699707C115.96875,546.4000129699707,398.1006464926286,546.4000129699707,439.29080130283165,546.4000129699707" stroke-width="2" marker-end="url(#raphael-marker-endblock55-objnmlpq)" stroke-dasharray="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></path><rect x="251.46484375" y="562.7333984375" width="56.8828125" height="17.33333396911621" rx="0" ry="0" fill="#ffffff" stroke="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></rect><text x="280.1263122558594" y="571.4000129699707" text-anchor="middle" font-family="Roboto" font-size="16px" stroke="none" fill="#000000" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); text-anchor: middle; font-family: Roboto; font-size: 16px;"><tspan dy="5.333321571350098" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);">response</tspan></text><path fill="none" stroke="#000000" d="M444.28387451171875,583.7333469390869C444.28387451171875,583.7333469390869,162.15197801909017,583.7333469390869,120.96182320888707,583.7333469390869" stroke-width="2" marker-end="url(#raphael-marker-endblock55-obj5okxg)" stroke-dasharray="none" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"></path></svg>
\ No newline at end of file
diff --git a/spec.bs b/spec.bs
index fc1414b..627dbcb 100644
--- a/spec.bs
+++ b/spec.bs
@@ -72,10 +72,10 @@ different situations. Some of the use cases of DBSC are:
### Signed in session ### {#example-signin}
<div class="example" id="signin-example">
- A user logs in to his social account. To protect the user's private data the
- site protects his logged in session with a DBSC session. If the user tries to
- log in with the same cookie file on a different device, the site can detect and
- refuse this as an unauthorized user.
+ A user logs in to their social account. To protect the user's private data the
+ site protects the logged in session with a DBSC session. If malware tries to
+ log in with the same cookie file on a different device, the site can detect
+ and refuse this as an unauthorized user.
</div>
### Device integrity ### {#example-device-integrity}
@@ -175,7 +175,7 @@ Relying Parties (RPs) could simply establish a DBSC session independently of the
Identity Provider (IdP). Unfortunately, most IdPs do not require a password if
the user is already logged in. If user interaction isn't required, malware can
use its temporary access to the user's machine to mimic the login flow and
-establish a DBSC session with a new private key the malware creates and can
+establish a DBSC session with a new private key the malware created and can
exfiltrate. This violates the security goals of DBSC.
Therefore, we need to link the RP and IdP session in some way. The simplest way
@@ -185,7 +185,7 @@ device, we trust that the private key is stored securely. But sharing keys acros
sites has complex privacy properties. In order to mitigate the privacy risks of
sharing a high-entropy identifier, we require that the RP already know the
public key and session identifier for the IdP's session. The RP will include the
-IdP URL, session id, and key in the `Secure-Session-Registration` header. If
+IdP URL, session id, and key in the [:Secure-Session-Registration:] header. If
the key is correct, the user agent will create a session on the RP with the same
key as the IdP.
@@ -203,7 +203,7 @@ the same key pair, so querying whether a user has a specific DBSC public key on
the IdP is much less than a one bit of entropy.
In order to further limit the value of successfully unmasking a user, we also
-require opt-in from the IdP through a .well-known. Browsers should limit the
+require opt-in from the IdP through a `.well-known`. Browsers should limit the
number of RP origins in that list. This will ensure that large groups of sites
cannot collaborate to unmask a single high-value user as they browse the web.
@@ -211,7 +211,7 @@ cannot collaborate to unmask a single high-value user as they browse the web.
Suppose the owners of `example.com` also run `example.co.uk`. Login always
happens on `example.com`, and is propagated to `example.co.uk` through link
decoration. In order to protect both sites with a DBSC session, `example.com`
-should continue to use its existing `Secure-Session-Registration` header:
+should continue to use its existing [:Secure-Session-Registration:] header:
```
Secure-Session-Registration: (ES256);path="/register";challenge="challenge"
@@ -230,6 +230,7 @@ on `example.com`. This allows DBSC to protect `example.co.uk` without requiring
users to reauthenticate on `example.com` at login. </div>
# Alternatives considered # {#alternatives}
+
## WebAuthn and silent mediation ## {#alternatives-webauthn}
# Server considerations # {#server-considerations}
@@ -238,7 +239,7 @@ In order to use DBSC, site owners need to establish two new endpoints:
the registration endpoint and the refresh endpoint.
The registration endpoint is contacted asynchronously after the browser receives
-the Secure-Session-Registration header. This endpoint should:
+the [:Secure-Session-Registration:] header. This endpoint should:
- Serve the session config, including a new session id.
- Persist and associate the request's public key with the session id.
@@ -249,21 +250,21 @@ cause browser agents to begin denial-of-service prevention mechanisms, or even
terminate the session. Both could lead to future requests without bound
cookies. The expected behavior of this endpoint is:
- Look up the public key and recent challenges for the session by id.
-- Validate the Secure-Session-Response header has signed a recent challenge with
+- Validate the [:Secure-Session-Response:] header has signed a recent challenge with
the correct key. Note that due to network latency and race conditions, it's
possible to receive a signature for an old challenge after issuing a new
challenge.
- Issue new bound cookies.
-- Serve the current session config.
+- Optionally update the current session config.
The refresh endpoint is likely to directly leak login state if cross-site
-fetches are allowed. Servers can check for a valid Sec-Secure-Session-Id header
-to ensure that incoming requests are initiated by the user agent and not a
-cross-site request. It's also recommended to set a narrow CORS policy on this
-endpoint, not allowing cross-site origins to make requests with credentials. The
-CORS integration has been designed to make this possible by implicitly including
-credentials when the deferred request does. For similar reasons, it's also
-recommended that the refresh endpoint refuse to be embedded via the
+fetches are allowed. Servers can check for a valid [:Sec-Secure-Session-Id:]
+header to ensure that incoming requests are initiated by the user agent and not
+a cross-site request. It's also recommended to set a narrow CORS policy on this
+endpoint and not allow cross-site origins to make requests with credentials. The
+CORS integration for DBSC has been designed to make this possible by implicitly
+including credentials when the deferred request does. For similar reasons, it's
+also recommended that the refresh endpoint refuse to be embedded via the
`X-Frame-Options` or `Cross-Origin-Resource-Policy` headers.
<div class="example" id="timing-leak-cors">
@@ -307,8 +308,9 @@ This document depends on the Infra Standard for a number of foundational
concepts used in its algorithms and prose [[!INFRA]].
## Session store ## {#framework-session-store}
-The user agent maintains a <dfn>session store</dfn>. It is an
-[=ordered map=] from [=host/registrable domain=] to [=session by id=].
+The user agent maintains a <dfn>session store</dfn>. It is an [=ordered map=]
+from [=host/registrable domain=] to [=session by id=]. Sessions should persist
+across user agent restarts.
## Sessions by id ## {#framework-sessions-id}
A <dfn>session by id</dfn> is an [=ordered map=] from
@@ -328,17 +330,17 @@ A <dfn>device bound session</dfn> is a [=struct=] with the following
: <dfn>cached challenge</dfn>
:: a [=string=] that is to be used as the next challenge for this session
: <dfn>session scope</dfn>
- :: a [=/session scope=] defining which [=URL=]s are in scope for this session
+ :: a [=/session scope=] defining which [=URLs=] are in scope for this session
: <dfn>session credentials</dfn>
- :: a [=list=] of [=session credential=]s used by the session, derived from
- [=/session credentials=]
+ :: a [=list=] of [=/session credentials=] used by the session, derived from
+ [=JSON session credentials=]
: <dfn>expiration timestamp</dfn>
:: a [=moment=] when this session should be removed.
: <dfn>session key</dfn>
:: a key pair used by the session. The private key
should be stored in a secure manner, see [[#security-considerations]].
: <dfn>allowed refresh initiators</dfn>
- :: a [=list=] of [=string=]s describing which hosts are allowed to initiate
+ :: a [=list=] of [=strings=] describing which hosts are allowed to initiate
DBSC refreshes due to non-CORS requests. See
[[#algo-request-allows-refresh]] for details.
</dl>
@@ -352,7 +354,7 @@ The <dfn>session scope</dfn> is a [=struct=] with the following
: <dfn>include site</dfn>
:: a [=boolean=] indicating if the session applies to an entire site or just an origin.
: <dfn>scope specifications</dfn>
- :: a [=list=] of [=scope specification=]s used by the session
+ :: a [=list=] of [=/scope specifications=] used by the session
</dl>
## Scope specification ## {#framework-scope-specification}
@@ -375,7 +377,8 @@ The <dfn>session credential</dfn> is a [=struct=] with the following
: <dfn>name</dfn>
:: a [=string=] that defines the name of the credential cookie
: <dfn>attributes</dfn>
- :: a [=string=] that defines the other attributes of the credential cookie
+ :: a [=string=] that defines the other attributes of the credential cookie.
+ User agents should supply the same defaults here as they would for cookies.
</dl>
## Registrable origin label## {#framework-registrable-origin-label}
@@ -465,10 +468,10 @@ if both `co.uk` and `de` are [=public suffixes=].
<div class="example" id="host-pattern-matches-example">
Some examples of pattern matches:
- - `https://example.com` matches `*`
- - `https://example.com` matches `example.com`
- - `https://example.com` does not match `*.example.com`
- - `https://subdomain.example.com` matches `*.example.com`
+ - `example.com` matches `*`
+ - `example.com` matches `example.com`
+ - `example.com` does not match `*.example.com`
+ - `subdomain.example.com` matches `*.example.com`
</div>
</div>
@@ -506,7 +509,7 @@ if both `co.uk` and `de` are [=public suffixes=].
## Identify missing session credential ## {#algo-identify-missing-session-credential}
<div class="algorithm" data-algorithm="identify-missing-session-credential">
- Given a [=request=] (|request|) and a [=/list=] of [=/session credential=]s
+ Given a [=request=] (|request|) and a [=/list=] of [=/session credentials=]
(|credentials|), returns a [=boolean=] indicating whether any |credential| in
|credentials| is missing on |request|.
@@ -787,8 +790,8 @@ id="add-debug-header">add the debug header</dfn> to a [=request=]
# DBSC Formats # {#format}
## \``Secure-Session-Registration`\` HTTP header field ## {#header-secure-session-registration}
-The \`<dfn export http-header id="secure-session-registration-header">
-<code>Secure-Session-Registration</code></dfn>\` header field can be used in a
+The <dfn export http-header id="secure-session-registration-header">
+<code>\`Secure-Session-Registration\`</code></dfn> header field can be used in a
[=response=] by the server to start a new [=/device bound session=] on the
client.
@@ -852,8 +855,8 @@ The following <a>sf-parameter</a>s are defined:
</div>
## \``Secure-Session-Challenge`\` HTTP Header Field ## {#header-secure-session-challenge}
-The \`<dfn export http-header id="secure-session-challenge-header">
-<code>Secure-Session-Challenge</code></dfn>\` header field can be used in a
+The <dfn export http-header id="secure-session-challenge-header">
+<code>\`Secure-Session-Challenge\`</code></dfn> header field can be used in a
[=response=] by the server to send a challenge to the client that it expects to
be used in future Secure-Session-Response headers inside the [=DBSC proof=], or to
request a newly signed [=DBSC proof=] right away if the [=response/status=]
@@ -866,7 +869,7 @@ The semantics of the item are defined in
The processing steps are defined in [[#algo-process-challenge]].
-### Secure-Session-Challenge structured header serialization ### {#challenge-structured-header-serialization}
+### [:Secure-Session-Challenge:] structured header serialization ### {#challenge-structured-header-serialization}
The [:Secure-Session-Challenge:] is represented as a Structured Field.[[!RFC9651]]
In this representation, a challenge is represented by a string.
@@ -906,13 +909,13 @@ case the session ID is optional.
```
</div>
-## `Secure-Session-Response` HTTP Header Field ## {#header-secure-session-response}
-The \`<dfn export http-header id="secure-session-response-header">
-<code>Secure-Session-Response</code></dfn>\` header field can be used in the
+## \``Secure-Session-Response`\` HTTP Header Field ## {#header-secure-session-response}
+The <dfn export http-header id="secure-session-response-header">
+<code>\`Secure-Session-Response\`</code></dfn> header field can be used in the
[=request=] by the user agent to send a [=DBSC proof=] to the server to prove
that the client is still in possession of the private key of the session key.
-\`<a http-header><code>Secure-Session-Response</code></a>\` is a structured
+<a http-header><code>\`Secure-Session-Response\`</code></a> is a structured
header. Its value must be a string. It's ABNF is:
<pre class="abnf">SecSessionChallenge = <a>sf-string</a></pre>
This string MUST only contain the [=DBSC proof=] JWT. Any <a>sf-parameter</a>s SHOULD be
@@ -925,13 +928,13 @@ ignored.
```
</div>
-## `Sec-Secure-Session-Id` HTTP Header Field ## {#header-sec-secure-session-id}
-The \`<dfn export http-header id="sec-secure-session-id-header">
-<code>Sec-Secure-Session-Id</code></dfn>\` header field can be used in the
+## \``Sec-Secure-Session-Id`\` HTTP Header Field ## {#header-sec-secure-session-id}
+The <dfn export http-header id="sec-secure-session-id-header">
+<code>\`Sec-Secure-Session-Id\`</code></dfn> header field can be used in the
[=request=] by the user agent to request the current session is refreshed,
with the current session identifier as a string argument.
-\`<a http-header><code>Sec-Secure-Session-Id</code></a>\` is a structured header.
+[:Sec-Secure-Session-Id:] is a structured header.
Its value must be a string. It's ABNF is:
<pre class="abnf">SecSessionIdentifier = <a>sf-string</a></pre>
This string MUST only contain the session identifier. Any parameters SHOULD be
@@ -944,9 +947,9 @@ ignored.
```
</div>
-## `Secure-Session-Skipped` HTTP header field ## {#header-secure-session-skipped}
-The \`<dfn export http-header id="secure-session-skipped-header">
-<code>Secure-Session-Skipped</code></dfn>\` header field can be used in a
+## \``Secure-Session-Skipped`\` HTTP header field ## {#header-secure-session-skipped}
+The <dfn export http-header id="secure-session-skipped-header">
+<code>\`Secure-Session-Skipped\`</code></dfn> header field can be used in a
[=request=] to indicate that the request is intentionally missing bound
credentials due to user agent policy.
@@ -971,18 +974,18 @@ One <a>sf-parameter</a> is defined:
</div>
-## DBSC Session Instruction Format ## {#format-session-instructions}
-The server sends <dfn>session instructions</dfn> during session
+## JSON Session Instruction Format ## {#format-session-instructions}
+The server sends <dfn>JSON session instructions</dfn> during session
registration and optionally during session refresh. If the response
contains session instructions, it MUST be in JSON format.
At the root of the JSON object, the following keys can exist:
: session identifier
:: a [=string=] representing a [=device bound session/session identifier=].
- If this [=session instructions=] is sent during a refresh request this MUST be
+ If this [=JSON session instructions=] is sent during a refresh request this MUST be
the [=device bound session/session identifier=] for the current session. If
not these instructions SHOULD be ignored.
- If this [=session instructions=] is sent during a registration it MUST either
+ If this [=JSON session instructions=] is sent during a registration it MUST either
be a unique identifier for this [=host/registrable domain=], or it will
overwrite the current [=device bound session=] with this identifier for the
current [=host/registrable domain=].
@@ -1000,15 +1003,15 @@ At the root of the JSON object, the following keys can exist:
This key is OPTIONAL, and if not present, the default value will be true.
: scope
- :: a [=dictionary=] of [=session scope instructions=] describing the request
- destinations covered by the session. This field MUST be present.
+ :: a [=JSON session scope=] describing the request destinations covered by
+ the session. This field MUST be present.
: credentials
- :: a [=list=] of [=/session credentials=] describing the cookies protected by
+ :: a [=list=] of [=JSON session credentials=] describing the cookies protected by
this session. This field MUST be present.
: allowed_refresh_initiators
- :: a [=list=] of [=string=]s describing which hosts are allowed to initiate
+ :: a [=list=] of [=strings=] describing which hosts are allowed to initiate
DBSC refreshes due to non-CORS requests. See
[[#algo-request-allows-refresh]] for details.
@@ -1052,8 +1055,8 @@ At the root of the JSON object, the following keys can exist:
```
</div>
-## DBSC Session Scope Instruction Format ## {#format-session-scope-instructions}
-The server sends <dfn>session scope instructions</dfn> in the [=session
+## JSON Session Scope Instruction Format ## {#format-session-scope-instructions}
+The server sends a <dfn>JSON session scope</dfn> in the [=JSON session
instructions=] during registration and optionally during session refresh.
At the root of the JSON object, the following keys can exist:
@@ -1067,19 +1070,19 @@ At the root of the JSON object, the following keys can exist:
:: a [=boolean=] indicating if the session is origin-scoped (false) or
site-scoped (true). This key is OPTIONAL; if not present, it will be false
(origin-scoped). Note that this takes precedence over any
- [=session scope rule=]s in [=scope specification=] (see
+ [=JSON session scope rules=] in [=scope specification=] (see
[[#algo-url-in-scope]]).
: scope_specification
- :: a [=list=] of [=session scope rule=]s describing modifications to the
+ :: a [=list=] of [=JSON session scope rules=] describing modifications to the
default scope (the entire origin or site). This key is OPTIONAL; if not
present, an empty list will be used.
-## DBSC Session Scope Rule Format ## {#format-session-scope-rule}
-The server sends <dfn>session scope rule</dfn>s in the [=session scope
-instructions=] during registration and optionally during session refresh.
+## JSON Session Scope Rule Format ## {#format-session-scope-rule}
+The server sends <dfn>JSON session scope rules</dfn> in the [=JSON session scope=]
+during registration and optionally during session refresh.
-At the root of each [=session scope rule=], the following keys can exist:
+At the root of each [=JSON session scope rule=], the following keys can exist:
: type
:: a [=string=] indicating whether the rule includes or excludes destinations.
This key MUST be present, and the value MUST be "include" or "exclude".
@@ -1092,8 +1095,8 @@ At the root of each [=session scope rule=], the following keys can exist:
:: a [=string=] indicating the path-prefixes that should match the rule. This
key MUST be present. See [[#algo-url-in-scope]] for the detailed semantics.
-## DBSC Session Credentials Format ## {#format-session-credentials}
-The server sends <dfn>session credentials</dfn> in the [=session
+## JSON Session Credentials Format ## {#format-session-credentials}
+The server sends <dfn>JSON session credentials</dfn> in the [=JSON session
instructions=] during registration and optionally during session refresh.
At the root of the JSON object, the following keys can exist:
@@ -1184,11 +1187,11 @@ present:
This specification requires an update to the <a
href="https://fetch.spec.whatwg.org/#http-network-or-cache-fetch">HTTP-network-or-cache
-fetch</a> algorithm. A [=request=] has a <dfn
-for="request">deferred device bound session ids</dfn>, a [=list=] of [=tuple=]s consisting of:
+fetch</a> algorithm. A [=request=] has a <dfn for="request">deferred device
+bound session ids</dfn>, a [=list=] of [=tuples=] consisting of:
- a domain (a [=host/registrable domain=]).
- a session id (a [=string=]).
-This list is initially empty. At the end of step 8.21, run
+This list is initially empty. After computing cookies in step 8.21, run
[[#algo-identify-session-needing-refresh]]. If the resulting
|session| is non-null:
1. Run [[#algo-session-request]] with the returned |session|'s
diff --git a/start.png b/start.png
deleted file mode 100644
index ed1064e..0000000
Binary files a/start.png and /dev/null differ