@theferrit32 Is OpenID 2.0 built on top of OAuth2.0? As far as I know OpenID 1.0 and OpenID 2.0 were developed well before OAuth 1.0 and OAuth 2.0 (en.wikipedia.org/wiki/OpenID)

I would have phrased better the sentence "The web application is the attack vector". The "web application" is the system that has the vulnerability that an attack vector tries to reach. Reaching the vulnerability requires to reach the system that has that vulnerability, so the system that has the vulnerability is always, and it can't be otherwise, implicitly an attack vector. IMHO, I would have phrased the sentence in "The SQLi application is the attack vector (possibly also the Internet, the client application, the web application itself implicitly, etc.; it depends on your focus).

Is there any degradation in the collision resistance if I truncate SHA256 to 60bits? Is there any formula to calculate the collision resistenze?

@brynk No, my inputs are not password, but just links

1. I would use a SHA function, which one? Depends on point 2. 2. Is there any really difference between MD5, SHA256, SHA512 given that each of than has un output longer than 60 bits?

@SteffenUllrich pretty clear

@schroeder Searching online I found this interesting solution cloudflare.com/ssl/keyless-ssl

@schroeder To be honest it's not a problem, I'm evaluating all possibilities. Apart from the certificate itself, I want to give my users the possibility to check the private key on their systems

@SteffenUllrich both the solutions you mentioned require me to host their SSL certificate on my server, the point here is that I don't want to host their SSL certificate or at least their private keys