Web Authentication & Identity Flows

Research question

Does approving an authentication request necessarily mean that the resulting web session is bound to the user and service they intended?

This research examines authentication across browsers, relying parties, identity providers, and external authentication devices. It includes WebAuthn, federated identity, identity-provider-mediated authentication, request-to-session binding, relay attacks, and relying-party context. A central concern is whether the information a user approves is securely connected to the session that is ultimately established.