mTLS与HTTP消息签名：保护HTTP请求的权衡分析
我一直在比较两种HTTP请求认证的方法：mTLS和HTTP消息签名（如RFC 9421）。<p>mTLS速度快，由TLS层处理，但在部署上比较复杂（例如证书、终止）。而HTTP签名在应用层提供了更多灵活性，但需要自定义逻辑和重放保护。<p>目前，我倾向于使用HTTP消息签名，因为它为像我这样的应用开发者提供了更多灵活性，并且我不必担心负载均衡等基础设施。我可以决定哪些API端点需要签名，以及请求的哪些部分将被签名。<p>我很好奇其他人在生产环境中使用什么。你们是如何在服务或设备之间保护请求的？尝试这两种方法有什么经验教训吗？
查看原文
I’ve been comparing two approaches to authenticating HTTP requests: mTLS and HTTP Message Signatures (like RFC 9421).<p>mTLS is fast and handled by the TLS layer, but has deployment complexity (e.g. certs, termination). HTTP signatures offer more flexibility at the app layer, but require custom logic and replay protection.<p>Currently, I'm on the HTTP Message Signatures train since it provides more flexibility to an app developer like me, and I don't have to worry about infrastructure such as load balancers. I can decide which API endpoints need signatures and which parts of the request will be signed.<p>Curious what others are using in production. How are you securing requests between services or devices? Any lessons from trying both?