When setting up the security for business to business API integration. We are discussion 2 option
- Mutual TLS with IP Filtering
- TLS with a Shared secret and IP Filtering.
Which is the more secure approach and what makes the potential difference?
My understanding is, either way, the initial connection secures the data then the shared secret or the second certificate confirms the identity (to an extent).
Are there any potential benefits either way? It seems Mutual TLS can be more challenging to implement. The only benefit I can think of with the Mutual TLS is the potential for the certificate to expire and be revoked.
I'm trying to understand the difference in the potential attacks.