Open a private security advisory on GitHub, or email the maintainer listed in
package.json. Please do not open a public issue for a vulnerability that
exposes session data.
Session Bridge moves live authentication state: cookies (including
HttpOnly session tokens), localStorage, and optionally IndexedDB and
Cache Storage. A package plus its transfer code is equivalent to a logged-in
browser. Treat both as credentials.
| Guarantee | How it is enforced |
|---|---|
| The relay cannot read sessions | Packages are AES-256-GCM encrypted in the source browser; the key is derived from a transfer code that the relay never receives. |
| The relay stores ciphertext only | Store.put() rejects any package whose alg is not AES-256-GCM, requires a non-empty ciphertext, and persists exactly the JSON it was given. GET /api/packages never returns package bodies. |
| A package cannot be re-targeted | format, version, alg, createdAt, expiresAt, transferId, target, and domains are bound as GCM additional authenticated data. Changing any of them breaks decryption. |
| Packages expire | The extension refuses a package claiming a lifetime over 5 minutes 30 seconds; the relay enforces its own independent TTL. |
| Relay writes need a token | Every /api route except /api/health requires Authorization: Bearer …, compared with hmac.compare_digest. |
| No page can trigger a transfer | There are no content scripts and no externally_connectable. All work is initiated from the popup or options page through chrome.runtime.sendMessage. |
| Secrets never reach the UI or logs | The popup renders counts only. redactForLog() scrubs value-bearing fields before anything is logged. |
- Passkeys / WebAuthn are hardware- or platform-bound and cannot be exported by any extension.
- Device-bound sessions (for example Google's DBSC) reject replay.
- Partitioned (CHIPS) cookies cannot be replayed outside their top-level site, so they are dropped and counted rather than silently included.
- A package plus its code is a complete credential. Anyone holding both can use the session until the site revokes it. Delivery over two channels reduces but does not eliminate this.
- Clipboard history (Windows
Win+V, clipboard managers) may retain a copy the extension cannot clear. - IP mismatch is not a cryptographic problem but is the most common cause of a transferred session being rejected. Use a proxy whose exit country matches the source browser.
- A compromised source machine, or a malicious extension already holding cookie permissions.
- Server-side session invalidation, revocation, or anti-fraud decisions made by the destination website.