Goal
The path to "セキュア・バイ・デザイン"
Here is the reading path leading up to this book, derived from its dependencies and ordered from the fundamentals.
The path so far (4 books)
Why read this first: Only with a foundation in signatures and public-key cryptography can you correctly understand token-based authorization. OAuth 2.0 is the de facto standard for delegating privileges; learn its grant types and flows from first principles.
Why read this first: Grasping the whole picture of ID management—from signup to logout to identity federation—in plain language lays the groundwork for the more specialized, detailed implementation covered by the OAuth 2.0 and OIDC protocol specs. Having organized the relationships among identity verification, authentication, and session management in Getting Started with Digital Identity makes it easier to place the authorization code flow and token validation covered in OpenID Connect Primer.
Sources
Why read this first: OAuth 2.0 is fundamentally an authorization protocol, and misusing it for pseudo-authentication breeds vulnerabilities. Advancing to OIDC, which standardizes identity verification, clarifies how to build correct authentication, including ID token validation.
Why read this first: Once you can implement authentication and authorization as a system, lift your perspective a level. Secure by Design goes beyond reactive input validation and escaping, offering a way to build structures where invalid data cannot enter at the design stage.