Home / Knowledge hub / Device binding
Knowledge hub
Device binding
Tying a session or token to one device so a copy elsewhere is refused.
What it means
Device binding is tying a session or token to the device it was issued to, so that a copy on another device is refused. Instead of trusting anyone who presents the token, the server also checks that the request comes from a device holding something that only the original device has.
The strongest form uses a cryptographic key the device keeps and never sends. DPoP, defined in RFC 9449, and mutual TLS both bind a token to such a key. Weaker forms compare browser details or the network address, and these are easier to get around.
Why it matters
A bearer token alone works for whoever holds it, so stealing one is enough to be treated as its owner. Binding raises the price for the thief. They have the token but not the key, and the request fails. This turns many token leaks from a live incident into a log entry, which is a far easier conversation with customers and auditors.
It is most useful where tokens are long-lived or the data is valuable: banking apps, admin consoles, and mobile apps with refresh tokens. It addresses token replay and some session theft, though not malware that is running on the genuine device itself and using its key.
How it shows up
Approaches include proof-of-possession tokens, keys held in the phone's secure hardware, mutual TLS between client and server, and softer signals such as a browser fingerprint. Softer signals are better used as a prompt to ask for another factor than as a hard block.
Binding to an IP address looks neat and breaks often: mobile users move between networks and offices share addresses. Fingerprints change with updates and can be spoofed. The mistakes: binding in the front-end only, treating a weak signal as proof, or no way to recover a legitimately changed device. Test by moving a token to another machine.
Questions people ask
Device binding, answered
Is device binding the same as MFA?
No. MFA asks the user for another factor at sign-in. Device binding checks, on every request, that the token is being used by the device it was issued to.
They complement each other.
Does binding to an IP address work?
Poorly. Mobile and home users change address often, and many people share one through a company network or carrier. It blocks genuine users and stops attackers who share a network.
Treat an address change as a signal to review, not as proof.
What is proof of possession?
It is a way of showing you hold a private key, without sending it. With DPoP the client signs each request with a key tied to the token, so a stolen token is useless without the key.
See bearer tokens for the weaker default.
Can attackers get around device binding?
If they control the device, or malware can use its key, yes. Binding stops a copied token being used elsewhere; it does not defend a compromised device.
Pair it with short token life and revocation.
When is device binding worth the effort?
When tokens live long or guard valuable actions, for example payment apps, admin panels and enterprise access. For short-lived tokens on low-risk data, shorter expiry may be enough.
Choose by the damage a stolen token could do.
Related
Terms that sit next to this one
Token replay
Reusing a stolen or captured token to be accepted as its rightful owner.
Bearer token
A token that works for whoever holds it, with no further proof of identity.
mTLS
A connection where both client and server prove who they are with certificates.
Session hijacking
Stealing the token that tells your application a browser is logged in.
Refresh token
A long-lived token used to get new short-lived access tokens without signing in again.
Does a stolen token work on another device?
We try tokens from your app on a different client and report what the server accepted, with the request and response, so you can judge whether binding is working in practice. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.