Domain
Web Security & Authentication
A learning path to study web security systematically on framework-independent first principles — from how HTTP works and the foundations of web vulnerabilities, through cryptography and authentication/authorization protocols, secure-by-design thinking, and threat modeling, to vulnerability assessment from an attacker's perspective.
The Terrain of This Field
The terrain of web security can be read as a chain of defenses that begins at a shoreline battered by the waves of attack. The water's edge is the "foundations of web vulnerabilities": on top of HTTP, learning why injection and XSS arise — their mechanisms and root remedies — is the trailhead of all defense.
Moving inland, you reach the gatehouse of "authentication and authorization." How do you verify identity and delegate privileges over stateless HTTP? Cryptography holds the key, and protocols like OAuth, OIDC, and passkeys give shape to trust.
Deeper still rises the high ground of "defending by design": beyond reactive validation, the philosophy of building structures where vulnerabilities cannot enter, and systematic defense through threat modeling. At the outermost ring stands the watchtower of "offense and assessment" — to defend, you must know how the attacker thinks. The axis running through this field is a consistent stance: defend in depth, from first principles, not by ad hoc patching.
Follow the arrows to read in order / solid = required, dashed = recommended
Share this map
Grouping
Difficulty
Difficulty
Dependencies
Computing layout...
Books in this domain
15 books
暗号技術入門 第3版
秘密の国のアリス
結城浩
実践理解！Webアプリケーション セキュリティ
Malcolm McDonald
はじめてのデジタルアイデンティティ
―Webサービスに欠かせない認証・認可・ID管理
いとうりょう
生成AIの安全性入門
綿岡晃輝
ハッキングAPI
Web APIを攻撃から守るためのテスト技法
Corey Ball
パスキーのすべて
導入・UX設計・実装
えーじ、倉林雅、小岩井航介
Real World HTTP 第3版
歴史とコードに学ぶインターネットとウェブ技術
渋川よしき
セキュアAPI
設計・構築・実装を貫く原則
José Haro Peralta
体系的に学ぶ 安全なWebアプリケーションの作り方 第2版
脆弱性が生まれる原理と対策の実践
徳丸浩
Webセキュリティ担当者のための脆弱性診断スタートガイド 第2版
上野宣が教える新しい情報漏えいを防ぐ技術
上野宣
ホワイトハッカー入門 第2版
阿部ひろき
セキュアなソフトウェアの設計と開発
脅威モデリングに基づく普遍的アプローチ
Loren Kohnfelder
OAuth徹底入門
セキュアな認可システムを適用するための原則と実践
Justin Richer、Antonio Sanso
OpenID Connect入門
アプリケーション開発者のための実践技術解説
土岐孝平
セキュア・バイ・デザイン
安全なソフトウェア設計
Dan Bergh Johnsson、Daniel Deogun、Daniel Sawano
Dependencies
Reason: Authentication, sessions, and cookies all sit on top of HTTP. Grasping HTTP's behavior from first principles first lets you understand structurally where in the protocol the vulnerabilities in Tokumaru's book actually arise.
Reason: Once Tokumaru's book has cemented the principles and root fixes, reinforce them with a modern, cross-layer view from browser to server. Widening the scope to supply chain and incident response raises the resolution of your defense.
Reason: After grasping the overall picture of vulnerability defense, descend to the cryptographic foundation that much of it relies on. Understanding the logic of hashing, signatures, and public-key crypto lets you treat TLS and token verification as principles rather than magic.
Reason: Only with a foundation in signatures and public-key cryptography can you correctly understand token-based authorization. OAuth 2.0 is the de facto standard for delegating privileges; learn its grant types and flows from first principles.
Reason: OAuth 2.0 is fundamentally an authorization protocol, and misusing it for pseudo-authentication breeds vulnerabilities. Advancing to OIDC, which standardizes identity verification, clarifies how to build correct authentication, including ID token validation.
Reason: Passkeys apply public-key cryptography to authentication. Reading this after the crypto basics makes it click why no password is stored on the server and why phishing resistance emerges — down to verifying the challenge signature.
Reason: Once you can implement authentication and authorization as a system, lift your perspective a level. Secure by Design goes beyond reactive input validation and escaping, offering a way to build structures where invalid data cannot enter at the design stage.
Reason: After grasping a robust, type-based design philosophy, advance to embedding it into the development process. STRIDE-based threat modeling systematically surfaces attack surfaces and trust boundaries, giving design reviews their backbone.
Reason: Once the principles of defense are solid, adopt the attacker's view. Learning API vulnerabilities (BOLA/IDOR, etc.) — now the main battleground for SPAs and microservices — from the offensive side lets you work backward to robust API design.
Reason: After learning the principles of vulnerabilities, verify them with your own hands. Dynamic analysis with OWASP ZAP and Burp Suite lets you feel how attacks you knew only in theory actually succeed in real traffic, closing the gap between theory and practice.
Reason: Once threat modeling has surfaced 'where the risks lie' at design time, confirm those assumptions through hands-on assessment. Matching design-level threats against actual behavior validates the effectiveness of your defenses.
Reason: Once you hold the principles of web defense, widen your scope to attacks across networks and servers. Knowing the attacker's thought process brings insights for active defense that are not confined to the web app alone.
Reason: With hashing and signatures as your cryptographic foundation, see how they play out across a real identity lifecycle. This book traces registration through login, recovery, and account closure as one continuous flow, moving from single-service authentication/authorization to identity-provider federation.
Sources
Reason: Once you hold the shape of ID management and identity federation, step into the implementation of the authorization protocol at its core. Working through OAuth 2.0's grants and flows in code clarifies pitfalls like token leakage and redirect URI tampering from first principles.
Sources
Reason: Once you understand OIDC's authorization code flow and JWT validation at the implementation level, widen your view to the security of the API as a whole. This book covers not only vulnerabilities rooted in authentication and authorization, but also API configuration risks, financial-grade API requirements, observability, and testing — building security in from the design stage.
Sources
Reason: After learning to defend APIs from the design stage with a shift-left mindset, check from the attacker's side whether that design actually holds up. Learning authorization-gap vulnerabilities like BOLA/IDOR from the offensive side lets you work backward to reassess the robustness of your design.
Sources
Reason: After gaining hands-on diagnostic experience with tools like OWASP ZAP and Burp Suite that closes the gap between theory and practice, turn that same posture — verifying defenses in the field — toward a new target. Generative-AI risk is evaluated through a different form, benchmarks and red-teaming, but the idea of backing up desk assumptions with verification carries over.
Sources
Reason: Once you've learned generative-AI risk classification, red-teaming-based safety evaluation, and system-level countermeasures like guardrails, you advance to embedding them into a mechanism that actually keeps running in production. LLMOps' closing chapter covers responding to security risks such as governance, privacy, and prompt injection, plus building an observability pipeline — connecting the evaluation and countermeasure knowledge from the AI safety primer into concrete production-operation mechanisms.
Sources
Reason: After learning the techniques of safety evaluation via benchmarks and red-teaming, you broaden your view to how the act of 'evaluating' concretely gets built into your own generative-AI product. This book on generative-AI application evaluation covers everything from building an evaluation perspective model to confusion matrices, RAG-oriented metrics, security evaluation, and AI agent evaluation along the development lifecycle, connecting the abstract idea of safety evaluation to your own product's quality-assurance process.
Sources
Explore next
Connected fields
Domain
DevOps / SRE
A staged learning path covering DevOps culture, continuous delivery, SRE, observability, containers, and IaC — moving from narrative to implementation. Build modern operations that balance high reliability and agility across organization, process, and technology.
Domain
Software Design
A systematic learning path for software design — from clean code to architecture, testing, and quality culture. Covers code quality, TDD, DDD, distributed system design, and DevOps/quality organization.