Stop stolen session cookies from being replayed.

A plugin that registers @fastify/cookie and the protocol routes for you.

const dbsc = createDbsc({ storage });
await dbsc.install(app);
await dbsc.bind(reply, sessionId, { userId });

Web-standard middleware. Runs on Node, Bun, Deno and Cloudflare Workers.

const dbsc = createDbsc({ storage });
dbsc.install(app);
await dbsc.bind(c, sessionId, { userId });

App Router. Export the middleware, read the session inside route handlers.

// middleware.ts
export default dbsc.middleware();
// route: const s = await dbsc.getSession(req);

A module mounts the protocol; DbscGuard protects routes; DbscService binds.

imports: [DbscModule.forRoot({ storage })]
// @UseGuards(DbscGuard) on a route
// this.dbsc.bind(res, sessionId, { userId })

Middleware over Koa's raw request and response objects.

const dbsc = createDbsc({ storage });
dbsc.install(app);
await dbsc.bind(ctx, sessionId, { userId });

A handle hook answers the routes; bind and guard inside actions.

// hooks.server.ts
export const handle = dbscHandle({ storage });
// await requireProof()(event) in a +server

The Electron main process plays server for your renderer. A bridge mounts the protocol on a custom scheme via protocol.handle; the renderer reaches the bound tier with the client SDK (native dbsc needs an https origin and hardware key store Electron rarely has).

const dbsc = createElectronDbsc({ storage });
const handleDbsc = dbsc.protocolHandler();
protocol.handle("app", (request) => handleDbsc(request));

No adapter for your framework? The generic node:http handler works with any server that exposes the Node request and response objects, and the framework-agnostic core wires into anything.

const handle = dbsc.handler();
createServer(async (req, res) => {
  if (await handle(req, res)) return; // protocol route answered
  // ... your routes; read getDbscSession(req)
});