Token Binding increases the security of traditional bearer tokens (cookies).

This Blog describes that ASP.NET can use Token Binding. As a security consultant, I'd like to observe or detect that this is done from an external perspective.


What technique (netmon) or tooling allows me to determine if token binding is in use for a given website?


When a server supporting the Token Binding protocol receives a bound token, the server compares the TLS Token Binding ID in the security token with the TLS Token Binding ID established with the client. If the bound token came from a TLS connection without a Token Binding, or if the IDs don't match, the token is discarded.


The problem is that I don't believe any client is implementing token binding which follows the draft. So you should create a test client yourself and then clear or change the private key and the bearer token should be dropped.

I wouldn't know why a client would want to have this tested on its servers. Are there any clients (software clients) who support token binding? It seems like .net is one of the first pieces of software to support the protocol. Also, the protocol is still a draft so it will take some time until we see adoption.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.