文档介绍：For your convenience Apress has placed some of the front
matter material after the index. Please use the Bookmarks
and Contents at a Glance links to access them.
Contents at a Glance
Foreword xv
About the Author xvii
About the Technical Reviewer xix
Acknowledgments xxi
Introduction xxiii
■■Chapter 1: e to Web API 1
■■Chapter 2: Building RESTful Services 13
■■Chapter 3: Extensibility Points 29
■■Chapter 4: HTTP Anatomy and Security 41
■■Chapter 5: Identity Management 81
■■Chapter 6: Encryption and Signing 103
■■Chapter 7: Custom STS through WIF 119
■■Chapter 8: Knowledge Factors 133
■■Chapter 9: Ownership Factors 163
■■Chapter 10: Web Tokens 191
■■Chapter 11: OAuth Using Live Connect API 227
■■Chapter 12: OAuth from the Ground Up 251
■■Chapter 13: OAuth Using OpenAuth 283
v
■ Contents at a Glance
■■Chapter 14: Two-Factor Authentication 319
■■Chapter 15: Security Vulnerabilities 345
■■Appendix: Web API Security Distilled 375
Index 381
vi
Introduction
es from not knowing what you’re doing.
—Warren Buffett
anizations can afford to have dedicated people working on application security. More often than not, a
developer or a lead developer from the team is entrusted with the responsibility for retrofitting security into the
application or a service. In this quest, the developer looks around, maybe Googles some information, asks a question
or two in forums, and rolls his own security implementation without knowing fully the underlying concepts and the
implications of the choices he made. This path of least resistance is usually taken because of the project schedule
pressures and the lack of emphasis or the focus that the nonfunctional aspect of security generally deserves.
Not reinventing the wheel is a great policy for application development teams because ponents
like libraries and frameworks help get things done efficiently and the right way, incorporating best practices. The
flip side of ponents,