How does this work with being able to verify the HTTPS URL? How do I know I'm typing my credentials into my legit SSO provider and not a phishing site?
And if the SSO server wants to share state with the other services, like forcing a logout on a specific app, it can always do it on the server side (app backend <-> SSO backend with user token).
But if that's the recommended approach, why are they providing a standard route to do SSO via an iframe with the Storage Access API? Does that API have any other valid uses that aren't tracking or SSO related?