Dependencies

1. 01Real World HTTP, 3rd Edition→Taikeiteki ni Manabu Anzen na Web Application no Tsukurikata, 2nd Edition (A Systematic Guide to Building Secure Web Applications)Recommended / From HTTP principles to vulnerability countermeasures

   Reason: Authentication, sessions, and cookies all sit on top of HTTP. Grasping HTTP's behavior from first principles first lets you understand structurally where in the protocol the vulnerabilities in Tokumaru's book actually arise.

   Sources

   • HTTP - MDN Web Docs
   • OWASP Top 10 - OWASP Foundation
2. 02Taikeiteki ni Manabu Anzen na Web Application no Tsukurikata, 2nd Edition (A Systematic Guide to Building Secure Web Applications)→Grokking Web Application SecurityRecommended / From principles and root fixes to a modern, cross-layer view

   Reason: Once Tokumaru's book has cemented the principles and root fixes, reinforce them with a modern, cross-layer view from browser to server. Widening the scope to supply chain and incident response raises the resolution of your defense.

   Sources

   • OWASP Top 10 - OWASP Foundation
3. 03Taikeiteki ni Manabu Anzen na Web Application no Tsukurikata, 2nd Edition (A Systematic Guide to Building Secure Web Applications)→Ango Gijutsu Nyumon, 3rd Edition (An Introduction to Cryptography)Recommended / From vulnerability fundamentals to the cryptography foundation

   Reason: After grasping the overall picture of vulnerability defense, descend to the cryptographic foundation that much of it relies on. Understanding the logic of hashing, signatures, and public-key crypto lets you treat TLS and token verification as principles rather than magic.

   Sources

   • A02:2021 Cryptographic Failures - OWASP Top 10
4. 04Ango Gijutsu Nyumon, 3rd Edition (An Introduction to Cryptography)→OAuth 2 in ActionRecommended / From the cryptography foundation to an authorization protocol

   Reason: Only with a foundation in signatures and public-key cryptography can you correctly understand token-based authorization. OAuth 2.0 is the de facto standard for delegating privileges; learn its grant types and flows from first principles.

   Sources

   • RFC 6749: The OAuth 2.0 Authorization Framework - IETF
5. 05OAuth 2 in Action→OpenID Connect Nyumon (Introduction to OpenID Connect)Recommended / From authorization with OAuth to authentication with OIDC

   Reason: OAuth 2.0 is fundamentally an authorization protocol, and misusing it for pseudo-authentication breeds vulnerabilities. Advancing to OIDC, which standardizes identity verification, clarifies how to build correct authentication, including ID token validation.

   Sources

   • How OpenID Connect Works - OpenID Foundation
6. 06Ango Gijutsu Nyumon, 3rd Edition (An Introduction to Cryptography)→Passkey no Subete (Everything About Passkeys)Recommended / From public-key cryptography to passkeys

   Reason: Passkeys apply public-key cryptography to authentication. Reading this after the crypto basics makes it click why no password is stored on the server and why phishing resistance emerges — down to verifying the challenge signature.

   Sources

   • Web Authentication: An API for accessing Public Key Credentials - W3C
   • Passkeys (Passwordless Authentication) - FIDO Alliance
7. 07OpenID Connect Nyumon (Introduction to OpenID Connect)→Secure by DesignRecommended / From implementing authentication and authorization to elimination by design

   Reason: Once you can implement authentication and authorization as a system, lift your perspective a level. Secure by Design goes beyond reactive input validation and escaping, offering a way to build structures where invalid data cannot enter at the design stage.

   Sources

   • OWASP Proactive Controls - OWASP Foundation
8. 08Secure by Design→Designing Secure SoftwareRecommended / From design philosophy to the threat modeling process

   Reason: After grasping a robust, type-based design philosophy, advance to embedding it into the development process. STRIDE-based threat modeling systematically surfaces attack surfaces and trust boundaries, giving design reviews their backbone.

   Sources

   • Threat Modeling - OWASP Foundation
9. 09Grokking Web Application Security→Hacking APIsRecommended / From defensive fundamentals to the attacker's view of APIs

   Reason: Once the principles of defense are solid, adopt the attacker's view. Learning API vulnerabilities (BOLA/IDOR, etc.) — now the main battleground for SPAs and microservices — from the offensive side lets you work backward to robust API design.

   Sources

   • OWASP API Security Project - OWASP Foundation
10. 10Taikeiteki ni Manabu Anzen na Web Application no Tsukurikata, 2nd Edition (A Systematic Guide to Building Secure Web Applications)→Web Security Tantosha no Tame no Zeijakusei Shindan Start Guide, 2nd Edition (A Vulnerability Assessment Start Guide for Web Security Staff)Recommended / From learned vulnerabilities to verification through assessment

    Reason: After learning the principles of vulnerabilities, verify them with your own hands. Dynamic analysis with OWASP ZAP and Burp Suite lets you feel how attacks you knew only in theory actually succeed in real traffic, closing the gap between theory and practice.

    Sources

    • OWASP Web Security Testing Guide - OWASP Foundation
11. 11Designing Secure Software→Web Security Tantosha no Tame no Zeijakusei Shindan Start Guide, 2nd Edition (A Vulnerability Assessment Start Guide for Web Security Staff)Related / From threat modeling assumptions to validation by hands-on assessment

    Reason: Once threat modeling has surfaced 'where the risks lie' at design time, confirm those assumptions through hands-on assessment. Matching design-level threats against actual behavior validates the effectiveness of your defenses.

    Sources

    • OWASP Web Security Testing Guide - OWASP Foundation
12. 12Grokking Web Application Security→White Hacker Nyumon, 2nd Edition (An Introduction to Ethical Hacking)Related / From web defense basics to a broader view of attack techniques

    Reason: Once you hold the principles of web defense, widen your scope to attacks across networks and servers. Knowing the attacker's thought process brings insights for active defense that are not confined to the web app alone.

    Sources

    • OWASP Top 10 - OWASP Foundation
13. 13Ango Gijutsu Nyumon, 3rd Edition (An Introduction to Cryptography)→Hajimete no Digital Identity (Getting Started with Digital Identity)Recommended / From cryptography fundamentals to an identity management overview

    Reason: With hashing and signatures as your cryptographic foundation, see how they play out across a real identity lifecycle. This book traces registration through login, recovery, and account closure as one continuous flow, moving from single-service authentication/authorization to identity-provider federation.

    Sources

    • Hajimete no Digital Identity (Getting Started with Digital Identity) - Gijutsu-Hyohron
14. 14Hajimete no Digital Identity (Getting Started with Digital Identity)→OAuth 2 in ActionRecommended / From an ID management overview to implementing an authorization protocol

    Reason: Once you hold the shape of ID management and identity federation, step into the implementation of the authorization protocol at its core. Working through OAuth 2.0's grants and flows in code clarifies pitfalls like token leakage and redirect URI tampering from first principles.

    Sources

    • Hajimete no Digital Identity (Getting Started with Digital Identity) - Gijutsu-Hyohron
15. 15OpenID Connect Nyumon (Introduction to OpenID Connect)→Secure APIsRecommended / From authentication and authorization to API-wide security design

    Reason: Once you understand OIDC's authorization code flow and JWT validation at the implementation level, widen your view to the security of the API as a whole. This book covers not only vulnerabilities rooted in authentication and authorization, but also API configuration risks, financial-grade API requirements, observability, and testing — building security in from the design stage.

    Sources

    • Secure APIs (Japanese edition) - Shoeisha
16. 16Secure APIs→Hacking APIsRelated / From defending APIs by design to probing them as an attacker

    Reason: After learning to defend APIs from the design stage with a shift-left mindset, check from the attacker's side whether that design actually holds up. Learning authorization-gap vulnerabilities like BOLA/IDOR from the offensive side lets you work backward to reassess the robustness of your design.

    Sources

    • Secure APIs (Japanese edition) - Shoeisha
17. 17Web Security Tantosha no Tame no Zeijakusei Shindan Start Guide, 2nd Edition (A Vulnerability Assessment Start Guide for Web Security Staff)→Seisei AI no Anzensei Nyumon (An Introduction to Generative AI Safety)Related / From web vulnerability assessment to generative AI safety evaluation

    Reason: After gaining hands-on diagnostic experience with tools like OWASP ZAP and Burp Suite that closes the gap between theory and practice, turn that same posture — verifying defenses in the field — toward a new target. Generative-AI risk is evaluated through a different form, benchmarks and red-teaming, but the idea of backing up desk assumptions with verification carries over.

    Sources

    • Seisei AI no Anzensei Nyumon (An Introduction to Generative AI Safety) - Gijutsu-Hyohron
18. 18Seisei AI no Anzensei Nyumon (An Introduction to Generative AI Safety)→LLMOpsRecommended / From AI safety theory to production operations governance

    Reason: Once you've learned generative-AI risk classification, red-teaming-based safety evaluation, and system-level countermeasures like guardrails, you advance to embedding them into a mechanism that actually keeps running in production. LLMOps' closing chapter covers responding to security risks such as governance, privacy, and prompt injection, plus building an observability pipeline — connecting the evaluation and countermeasure knowledge from the AI safety primer into concrete production-operation mechanisms.

    Sources

    • LLMOps (Japanese edition) - O'Reilly Japan
19. 19Seisei AI no Anzensei Nyumon (An Introduction to Generative AI Safety)→Seisei AI Application Hyoka Nyumon (An Introduction to Evaluating Generative AI Applications)Related / From AI safety evaluation concepts to evaluating your own product

    Reason: After learning the techniques of safety evaluation via benchmarks and red-teaming, you broaden your view to how the act of 'evaluating' concretely gets built into your own generative-AI product. This book on generative-AI application evaluation covers everything from building an evaluation perspective model to confusion matrices, RAG-oriented metrics, security evaluation, and AI agent evaluation along the development lifecycle, connecting the abstract idea of safety evaluation to your own product's quality-assurance process.

    Sources

    • Seisei AI Application Hyoka Nyumon (An Introduction to Evaluating Generative AI Applications) - Gijutsu-Hyohron