Collected research

Explicating SDKs: Uncovering Assumptions Underlying Secure Authentication and Authorization

Rui Wang, Yuchen Zhou, Shuo Chen, Shaz Qadeer, David Evans and Yuri Gurevich · cs.virginia.edu

Wang, Zhou and colleagues build semantic models of Facebook and Microsoft authentication SDKs together with the runtime systems beneath them, then use a formal analysis tool to reason over every app buildable on each SDK. The models expose implicit assumptions developers never see; violations earned Facebook bug bounties, changed the OAuth 2.0 spec and left most studied apps exploitable.

Record

Researcher

Rui Wang, Yuchen Zhou, Shuo Chen, Shaz Qadeer, David Evans and Yuri Gurevich

Published by

cs.virginia.edu

Topic

Identity

In the archive

• Collected in the 2013 research round

Related sources

• Explicating SDKs Whitepaper
• Explicated SDKs

Tags

• oauth
• sso
• formal-analysis
• auth-bypass
• static-analysis
• bug-bounty
• owasp-a01-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of Rui Wang, Yuchen Zhou, Shuo Chen, Shaz Qadeer, David Evans and Yuri Gurevich, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 11 August 2026.