[Feature Request] Add clear UI indicators for DBSC browser support

[christianTNG]

Thanks for driving the roll out of DBSC! 🎉

I would like to propose a new feature: adding clear visual indicators to the prototype page whether the user's browser (and config and hardware) supports starting and refreshing a session with DBSC. This would make it much easier for users to verify at a glance if their browser configuration is compatible with DBSC, without needing to inspect ambiguous internal logs.

See for example this mock:

Implementation Idea: The success messages could be triggered server-side based on the session state:

• Start Session Support: Display when a session is successfully bound (i.e., when the server receives an /internal/StartSession request with a valid key).
• Refresh Session Support: Display when any session's hasEverRefreshed flag becomes true.

Thank you!

[thefrog-gh]

Hello! Something we've been working on recently is having DBSC be debuggable in Chrome DevTools. For now this is still behind a chrome://flags entry "Device Bound Session Credentials (Standard) DevTools Debugging" and it is still in progress. It has a basic version in M145 and a version with more features in M146. You'll find a new "Device Bound Sessions" section in the Application panel if you enable the flag, and then you can see if registrations are going through. Does that help with your debugging use case?

[christianTNG]

Thanks a lot for the awesome hint for the debugging flag: the new section in the Application panel directly clarifies it for me! However, the feature request might also concern other (maybe even non-dev) users, like coworkers or customers, to allow them to quickly check their browser and hardware compatibility with DBSC on their own.

[thefrog-gh]

I think you should be able to use https://wpt.live/device-bound-session-credentials/create-session.https.html for this. It's an automated test that attempts to create and refresh a DBSC session. For now this will only work with the appropriate chrome://flags enabled because DBSC is not yet enabled by default. Once DBSC is enabled by default, there shouldn't be any special flags needed. However, note that the signing quota applies on this testing site as well; if you refresh the page many times in a short period of time without an override for the signing quota (e.g. with chrome://flags entry Enabled - For Developers), it may start failing.

[christianTNG]

Thanks for the additional hint. Both tests work fine with "Enabled - For Developers" for me (Beta 145 and Stable 144). When writing this feature request I was rather thinking about a future, shiny variant of this test also for end-users similar to Cloudflare's recent Post-Quantum (PQ) encryption browser support detection: