Software Security for Developers: With Examples in Java and Spring

by Adib Saikali, Laurentiu Spilca

360 pages, Paperback

Published June 9, 2026

Reviews

[RK · Rating 4 out of 5]

With the growing reliance on AI-assisted coding, managing application security is more critical than ever, as humans ultimately have to own the code they are responsible for. As the authors of Software Security for Developers note early on: "While developers often focus on libraries, frameworks, and tools at the mid-level, true security stems from foundational knowledge of standards, protocols, and patterns, as well as adherence to corporate and industry security practices."

The first section provides the big picture and does a good job of explaining the high-level security vocabulary of modern software systems, which is further unraveled in subsequent chapters. The following sections move into deep cryptography primitives (AES, RSA, ECC), implementing secure transport layers (mTLS, X.509 certificates), and mastering enterprise-grade identity patterns like OAuth2, OpenID Connect (OIDC), PKCE, WebAuthn, and microservice call-chain authorization. The code examples are Java-centric, so the book will appeal more to developers familiar with the Java stack, while non-Java developers will have to put in some effort to translate the examples.

The illustrations are helpful and nicely complement the content. The comparison & matrix tables across the book, make the topics more understandable. The concise chapter summaries & exercise answers providing reasoning to commonly asked questions are good takeaways especially if you're preparing for technical interviews. While I liked the conversational tone, the writing could have been a little tighter and more engaging. Overall, the book is useful and thought-provoking, as it forces developers to stop treating security as someone else's problem (like the DevOps or SecOps teams).

[C. · Rating 5 out of 5]

I have probably read or at least started dozens of book on application security over the years. Most of them have suffered from being overly dense and quickly degenerate into math-heavy cryptography cryptography passages and graphics or on the other side lack a hands-on context which results in both becoming boring and overly academic books. I found this book to be the exact opposite, the authors wrote a hands-on and practical book on application security. Yes OPSEC/APSEC is filled with acronyms and it's easy to feel overwhelmed however the authors uses a building block approach to lead the read through being to understand the different building blocks and what area of security they address as well as how to the pieces fit together. It is a very modern book with well known stack of Java and Spring but also Kubernetes - the default container platform the industry has more or less standardized on. I felt the chapters were in-depth without ever feeling like the ran on to long. The images used to explain concepts were clear, intuitive and well thought out. I think this book would equally serve DevOps and SecOps as well the Developers mentioned in the book's title. Although the book is Java and Spring based, the concepts are transferable to any language or stack. I highly recommend this book and kudos to the authors.

[Sathish Kumar · Rating 4 out of 5]

Security is one of those areas that is easy to lose touch with if you aren't working with it every day. This book has everything that I needed to brush up on this topic.

Give it a few pages and once you skim through the first chapter, the interesting parts really arrive. I specifically liked Chapters 9, 10, and 11, which cover X.509 certificates, TLS, and JSON Object Signing and Encryption (JOSE). I found these chapters to be well structured, offering clear, step by step practical walkthroughs that make complex concepts easy to grasp. The book also provides foundation on Cryptography. A minor criticism, I felt some places were text heavy and easy to lose focus (especially if you have a short attention span).

It is worth noting that the book doesn’t take a deep dive on every single mechanism. It focuses on crucial security topics, giving you enough ground to confidently get started and later explore advanced concepts on your own. I highly recommend it and will definitely be one of my go-to reference for this topic moving forward.

[Christoph Schubert · Rating 5 out of 5]

I read this books as a reviewer for Manning (without any monetary incentive, just pure interest in the topic) and have to say, that I really liked it!
The topic of security in software development is usually handled either to high level without clear guidance, or way too deep on a level that only experts understand.
This book goes to the right level, with practical examples on how to implement/use secure constructs based on what your use case needs. I highly recommend it for anyone interested in software development security to improve their understanding (or refresh, in case you already are an expert).

[Özay Duman · Rating 5 out of 5]

This is a well-structured, insightful, and highly practical book that explains software security in a clear and accessible way. It successfully goes beyond framework-specific details to focus on core concepts that are applicable across different languages and platforms, making it a valuable resource for developers who want to build secure applications.

[Deepak Kumar · Rating 5 out of 5]

One of the best books I found on application security which shares in-depth insights and great examples.