Web OAuth-based SSO Systems Security

In the present digital world, users have to access multiple applications for carrying out their day-to-day business activities. As the amount of apps increase, the number of credentials (e.g. username/password) for each user increases and thereby the possibility of losing or forgetting them also increases. Single Sign-On (SSO) can be used to solve many problems related to web user authentication. OAuth-based SSO Systems are widely deployed by big tech companies such as Facebook and Google. In this paper we provide an in-depth review analysis of OAuth-based SSO systems security issues. In fact, previous efforts have been aimed either at finding errors in specific implementations, or at finding security problems within the specification itself. The main paper contribution is twofold: (1) describe in detail the OAuth 2.0 authorization flows and summarize the differences between the flows of each scenario that affect the security of the OAuth 2.0 protocol, and (2) examine the security problems related to the OAuth 2.0 specification and its implementation in the Web environment.