Book
セキュアAPI
José Haro Peralta
Summary
API開発の設計・構築・運用の各段階にセキュリティ対策を組み込む「シフトレフト」の考え方を 解説する一冊。認証・認可における典型的な脆弱性やAPI設定管理上のリスクを具体例とともに 整理し、安全なAPIインフラの構築、金融グレードAPIの要件、オブザーバビリティ、セキュリティ テストの手法まで扱う。著者は数百件のAPIレビュー経験を持つセキュリティ専門家で、設計段階 から運用まで一貫した視点で対策を検討できる構成になっている。
Target Readers
- APIの設計・構築を担当するバックエンドエンジニア
- 認証・認可の実装や見直しを行う開発者
- セキュリティ観点でAPI基盤を強化したいエンジニア
Tags
Colophon
- Publisher
- 翔泳社
- ISBN
- 978-4-7981-9633-6
- Published
- Jul 2026
- List price
- ¥4,950incl. taxMay differ from the actual selling price on Amazon
Get this book
* The link above is an advertisement via Amazon Associates.Related Books
Prerequisites
- Recommended
The Design of Web APIs
The Design of Web APIs
Arnaud Lauret
Reason: Having grasped the practice of API design—contract-first with OpenAPI, pagination, versioning—you start to see the next challenge: how to build security into that design. Secure APIs builds up a shift-left perspective, addressing authentication/authorization vulnerabilities and API configuration risks starting from the design stage.
Sources
- Recommended
OpenID Connect入門
土岐孝平
Reason: Once you understand OIDC's authorization code flow and JWT validation at the implementation level, widen your view to the security of the API as a whole. This book covers not only vulnerabilities rooted in authentication and authorization, but also API configuration risks, financial-grade API requirements, observability, and testing — building security in from the design stage.
Sources
Next Books
- Related
Hacking APIs
Corey Ball
Reason: After learning to defend APIs from the design stage with a shift-left mindset, check from the attacker's side whether that design actually holds up. Learning authorization-gap vulnerabilities like BOLA/IDOR from the offensive side lets you work backward to reassess the robustness of your design.
Sources