{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,20]],"date-time":"2026-07-20T14:07:06Z","timestamp":1784556426101,"version":"3.55.0"},"reference-count":37,"publisher":"IEEE","license":[{"start":{"date-parts":[[2024,7,8]],"date-time":"2024-07-08T00:00:00Z","timestamp":1720396800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/2.zoppoz.workers.dev:443\/https\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2024,7,8]],"date-time":"2024-07-08T00:00:00Z","timestamp":1720396800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/2.zoppoz.workers.dev:443\/https\/doi.org\/10.15223\/policy-037"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2024,7,8]]},"DOI":"10.1109\/eurosp60621.2024.00016","type":"proceedings-article","created":{"date-parts":[[2024,8,22]],"date-time":"2024-08-22T17:41:43Z","timestamp":1724348503000},"page":"139-154","source":"Crossref","is-referenced-by-count":5,"title":["CSRFing the SSO Waves: Security Testing of SSO-Based Account Linking Process"],"prefix":"10.1109","author":[{"given":"Andrea","family":"Bisegna","sequence":"first","affiliation":[{"name":"Fondazione Bruno Kessler,Center for Cybersecurity,Trento,Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Matteo","family":"Bitussi","sequence":"additional","affiliation":[{"name":"Fondazione Bruno Kessler,Center for Cybersecurity,Trento,Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Roberto","family":"Carbone","sequence":"additional","affiliation":[{"name":"Fondazione Bruno Kessler,Center for Cybersecurity,Trento,Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Luca","family":"Compagna","sequence":"additional","affiliation":[{"name":"SAP Security Research,France"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Silvio","family":"Ranise","sequence":"additional","affiliation":[{"name":"Fondazione Bruno Kessler,Center for Cybersecurity,Trento,Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Avinash","family":"Sudhodanan","sequence":"additional","affiliation":[{"name":"CA,USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","volume-title":"Supporting materials"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/CSF.2010.27"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2022.102859"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.3233\/JCS-140503"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1145\/1455770.1455782"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-80825-9_2"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.19107\/IJISC.2019.01.06"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-64455-0_5"},{"key":"ref9","first-page":"1493","article-title":"WPSE: Fortifying Web Protocols via Browser-Side Security Monitoring","volume-title":"27th USENIX Security Symposium (USENIX Security 18)","author":"Calzavara","year":"2018"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSPW54576.2021.00012"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3417869"},{"key":"ref12","volume-title":"Burp Suite Community Edition. Portswigger"},{"key":"ref13","first-page":"1475","article-title":"O Single Sign-Off, Where Art Thou? An Empirical Analysis of Single Sign-On Account Hijacking and Session Management on the Web","volume-title":"27th USENIX Security Symposium (USENIX Security 18)","author":"Ghasemisharif","year":"2018"},{"key":"ref14","article-title":"Same-site cookies draft-west-first-party-cookies-07","author":"Goodwin","year":"2016","journal-title":"Technical report"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.14722\/madweb.2020.23008"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/SECCOM.2007.4550368"},{"key":"ref17","first-page":"2525","article-title":"JAW: Studying Client-side CSRF with Hybrid Property Graphs and Declarative Traversals","volume-title":"30th USENIX Security Symposium (USENIX Security 21)","author":"Khodayari","year":"2021"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833637"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-13257-0_34"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1145\/3471621.3471846"},{"key":"ref21","volume-title":"OAuth 2.0 Security Best Current Practice","author":"Lodderstedt","year":"2022"},{"key":"ref22","volume-title":"The Deputies are Still Confused","author":"Lundeen"},{"key":"ref23","volume-title":"Mozilla. Fetch metadata request header"},{"key":"ref24","volume-title":"Mozilla. SameSite cookies"},{"key":"ref25","volume-title":"OWASP. Cross Site Request Forgery (CSRF)"},{"key":"ref26","article-title":"What changed from 2013 to 2017?","volume-title":"OWASP"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2014.23021"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23386"},{"key":"ref29","article-title":"Open Web Application Security Project","volume-title":"Cross-Site Request Forgery Prevention Cheat Sheet"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-20550-2_13"},{"key":"ref31","first-page":"5539","article-title":"Cookie Crumbles: Breaking and Fixing Web Session Integrity","volume-title":"32nd USENIX Security Symposium (USENIX Security 23)","author":"Squarcina","year":"2023"},{"key":"ref32","volume-title":"Getting started with Selenium: Guide to automated UI testing"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2016.23286"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2017.45"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1145\/2382196.2382238"},{"key":"ref36","first-page":"399","article-title":"Explicating SDKs: Uncovering assumptions underlying secure authentication and authorization","volume-title":"22nd USENIX Security Symposium (USENIX Security 13)","author":"Wang"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1145\/2897845.2897874"}],"event":{"name":"2024 IEEE 9th European Symposium on Security and Privacy (EuroS&P)","location":"Vienna, Austria","start":{"date-parts":[[2024,7,8]]},"end":{"date-parts":[[2024,7,12]]}},"container-title":["2024 IEEE 9th European Symposium on Security and Privacy (EuroS&P)"],"original-title":[],"link":[{"URL":"https:\/\/2.zoppoz.workers.dev:443\/http\/xplorestaging.ieee.org\/ielx8\/10628975\/10628519\/10628999.pdf?arnumber=10628999","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,8,31]],"date-time":"2024-08-31T04:53:33Z","timestamp":1725080013000},"score":1,"resource":{"primary":{"URL":"https:\/\/2.zoppoz.workers.dev:443\/https\/ieeexplore.ieee.org\/document\/10628999\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,7,8]]},"references-count":37,"URL":"https:\/\/2.zoppoz.workers.dev:443\/https\/doi.org\/10.1109\/eurosp60621.2024.00016","relation":{},"subject":[],"published":{"date-parts":[[2024,7,8]]}}}