SoK: Single Sign-On Security — An Evaluation of OpenID Connect
The devil is in the (implementation) details: an empirical analysis of OAuth SSO systems