A staged reading list for anyone learning web application security, from authentication and authorization to secure design. Each pick has its own review on this blog, and every entry links to it. The order follows a learning path: OAuth-based authorization, digital identity, and secure design and implementation.
Why learn security
Get authentication or authorization wrong, and you open the door to leaks and unauthorized access. Understand the mechanisms well, and you move past leaving it all to the framework. Building safety in from the design stage becomes a need for every developer.
1. Ground yourself in authorization (OAuth)
A Thorough Introduction to OAuth
A staple that explains the principles and practice of OAuth authorization in a systematic way. You come to understand the terms and flow in depth. I cover it in the review.
A Tutorial Guide to Using OAuth 2.0
A book for relearning OAuth 2.0, which many use on vibes alone, in an organized way. You grasp the flow as you work through it. I wrote it up in the review.
2. Understand digital identity
Getting Started with Digital Identity
A gentle take on the basics of authentication, authorization, and ID management that web services depend on. It suits anyone who wants to start by sorting out the terms. My notes are in the review.
Digital Identity: A Complete Guide
A broad, systematic tour of safe, user-centered identity systems. It helps when you want the whole design picture. See the review.
Passkeys: A Complete Guide
It covers passkeys, a replacement for passwords, from adoption to UX design and implementation. It shows the next options for authentication in concrete terms. I cover it in the review.
3. Design and build securely
Secure by Design
It teaches how to build safety in from the design stage. You learn security as practice, not an afterthought. I wrote it up in the review.
Secure API: Principles Across Design, Build, and Implementation
It gathers security principles that run from API design through implementation. It raises the safety of API development. My notes are in the review.
Building Secure and Reliable Systems
A hefty volume on designing, building, and maintaining safe systems, drawn from Google SRE. You gain a view that holds reliability and security together. See the review.
Wrap-up
Start by building a base in authentication and authorization with OAuth and digital identity. Go deep on secure design and implementation once your target system takes shape. Every book has a full review here, so start with whichever one interests you most.
