SoK: Single Sign-On Security — An Evaluation of OpenID Connect
More Guidelines Than Rules: CSRF Vulnerabilities from Noncompliant OAuth 2.0 Implementations