Device-bound session control is a security model that links a live session cookie or token to one specific device. Instead of treating a session as valid anywhere, the service checks that the same device presents the session again, often using cryptographic proof, a device key, or trusted hardware signals. If the cookie is copied to another machine, it should fail to replay.
This matters because stolen sessions are a common way attackers bypass passwords and even MFA. Infostealers, phishing kits, and browser malware can grab reusable session material, then replay it from a different device. Device binding reduces the value of that theft and gives defenders a stronger signal for detecting abuse. In practice, services may require reauthentication when the device changes, revoke sessions on risk events, or combine binding with short lifetimes and continuous verification. It is not perfect, but it makes session theft much less useful.