I'm implementing client certificate authentication. My server is behind a proxy to which I have no control of. And also I don't have any control over the client side communication. During every request, the client side sends an additional header containing the client cert.
From the client help doc,
If your server is behind an HTTPS proxy that does not convey client certificates, then the client identity could be placed in an additional HTTP header as BASE64-encoded CMS Detached Signature of the message. Your server can validate the body with the detached signature with this header. If the validation is successful, your server can assume that the message came from the signer, whose certificate is stored in the signature.
I tried this and it worked fine.
I then set up burp proxy to the client, made the client to trust burp server certificate and captured one of client's request in burp. Then with repeater, I resend the request, and the request passed.
I'm a beginner, so I'm unsure whether this burp style capturing is an easy thing for any attacker. is it?
My doubt is "Is depending solely on this detached signature in the header a good idea to verify the authenticity of clients?" or should I go with the TLS handshake route by forwarding requests from the proxy to my server (but still I'm unsure if I could configure the proxy).