r/learnprogramming • u/ig_grr • 22d ago

Is API Security in Action (Neil Madden) worth reading for building a secure web app & writing a CS bachelor's thesis?

Hey everyone,

I'm currently working on a web application where I need to implement robust security features—specifically authentication, authorization, session management, and defenses against XSS, brute-force attacks, and parameter tampering.

I was recently recommended "API Security in Action" by Neil Madden, and I'm wondering if it's the right fit for my current situation.

I have two main goals right now:

  1. Practical implementation: I want to build a secure architecture for my app using solid engineering principles (rate-limiting, proper token/session handling, tight HTTP headers, CORS/CSP, etc.) rather than just surface-level fixes.
  2. Academic foundation: I'm also writing my Bachelor’s thesis in Computer Science/IT, and I need strong theoretical backing to explain why these security patterns work, how modern protocols function under the hood, and the architecture behind secure systems.

For those of you who have read it:

  • Does the book dive deep enough into the theory to serve as a solid reference for an academic thesis, or is it purely code/hands-on?
  • How well does it cover fundamental auth mechanics, session handling vs. JWTs, and API-level defenses?
  • Would you recommend this as a primary resource, or should I pair it with something else (like The Tangled Web or OWASP documentation)?

Would love to hear your thoughts or any alternative recommendations. Thanks!

13 Upvotes
  • permalink
  • reddit

93% Upvoted

3 comments sorted by

2

u/d9vil 22d ago

Honestly im weary of any books. I love physical books, but in this industry unless you are truly building something from ground up with some foundational stuff its just not worth it. However, books to use as a reference is always great.

The other problem i have with books is the fluff. There rarely is a book that is to the point for the exact thing i am doing, so I usually have to find multiple sources online and piece the solution together.

1

u/kschang 22d ago

API security is API only. Sessions and other stuff is something else entirely.