Goal
The path to "OpenID Connect入門"
Here is the reading path leading up to this book, derived from its dependencies and ordered from the fundamentals.
The path so far (6 books)
Why read this first: Once you understand how TCP/IP and HTTP work, the design decisions of REST APIs built on top of them make sense down to the 'why.' Web API: The Good Parts offers practical guidance on URIs, methods, and status codes grounded in HTTP semantics.
Why read this first: After grasping the overall picture of vulnerability defense, descend to the cryptographic foundation that much of it relies on. Understanding the logic of hashing, signatures, and public-key crypto lets you treat TLS and token verification as principles rather than magic.
Why read this first: Only with a foundation in signatures and public-key cryptography can you correctly understand token-based authorization. OAuth 2.0 is the de facto standard for delegating privileges; learn its grant types and flows from first principles.
Why read this first: OAuth 2.0 is fundamentally an authorization protocol, and misusing it for pseudo-authentication breeds vulnerabilities. Advancing to OIDC, which standardizes identity verification, clarifies how to build correct authentication, including ID token validation.
Why read this first: Once you have the Web's foundational technologies down, you move to the practice of designing 'good APIs' with them. Web API: The Good Parts offers established patterns for URI design, error representation, and versioning faithful to HTTP semantics, turning principles into design decisions.
Why read this first: Once you can design an API, you need an authentication and authorization layer that controls who may call it and with what privileges. OpenID Connect standardizes identity verification on top of OAuth 2.0, providing the established way to build token-based access control into an API.