The Web SSO Standard OpenID Connect: In-depth Formal Security Analysis and Security Guidelines
The devil is in the (implementation) details: an empirical analysis of OAuth SSO systems