Let's set the scene with two servers:
- an "auth" server which provides users with authorization tokens containing claims relevant to their account
- a "paywall" server, which after receiving payment from a user, will send a request to the auth server to add the "premium" claim to the user's account (and also this server can serve out restricted content to users who have the claim)
Both servers have access to a shared secret key, so the paywall server can verify the user's claim to view restricted content.
I want to verify that any claim-altering-requests which the auth server receives are actually coming from my trusted paywall server.
My thinking is that the paywall server should simply sign every claim-altering-request in its entirety within a JSON Web Token, such that the auth server can verify the identity of the sender, and also verify that none of the requests have been tampered with.
In this case, it seems like the entire request body would simply be one big JSON Web Token (instead of a mere Authorization header) because I can't trust any data which isn't signed within the JWT.
Does this reasoning make sense, or is this overkill? is my solution redundant? perhaps HTTPS can already effectively solve this problem? I think of HTTPS as a means to secure the communications between two points, however, this might not guarantee the identity of either end?