Can anybody recommend a tutorial or book on how to do Authentication properly? Say for the usecase SPA + REST API. If I google quickly I mostly just find tutor

Can anybody recommend a tutorial or book on how to do Authentication properly? Say for the usecase SPA + REST API. If I google quickly I mostly just find tutorials that turn out to be ads for some 3rd party service. Or other beginner tutorials that don't seem very trustworthy. I feel like I'm missing something, since this should be a very common use case for most (web) apps. (Bonus if it also covers User Authorization, i.e. different roles that are allowed to do things or not.) Thanks.