session

const (
	DbscSessionRegistrationHeaderName = "Secure-Session-Registration"
	DbscSessionResponseHeaderName     = "Secure-Session-Response"
	DbscSessionChallengeHeaderName    = "Secure-Session-Challenge"
	DbscSessionIdHeaderName           = "Sec-Secure-Session-Id"
)

The header names follow the Device Bound Session Credentials protocol, which renamed them from Sec-Session-* to Secure-Session-* during its second origin trial. Chrome ignores a registration header it does not recognise, so the old names left the mechanism silently inactive.