I have a server that sends webhook notifications to client servers. Before the client server begins processing anything, it should be certain that the webhook originated from my server, and that it was not altered or spoofed.
I can use a JSON Web Token (JWT) to sign the request and payload with a pre-shared secret key to ensure all of the above.
Is this completely redundant if the webhook is sent over HTTPS anyway?
It depends.
Most regular HTTPS connection are only authenticated for a single side (usually the server), mutual authentication is much less common. When there is only single side authentication, JWT signing can be used to authenticate the other side. If your TLS connection is already mutually authenticated using both Client and Server Certificate, then JWT signing may be redundant.
One case where JWT signing may not be redundant even if you already use mutually authentication is if the recipient needs to save the request and signature to allow an independent third party (e.g. regulators) to be able to audit that you were really the one that made the request (though for this case, you're going to need asymmetric signature rather than preshared key signature).
