I need to perform sensitive REST API calls between 2 server applications that I am writing. To do this I need to be able authenticate the server that is performing the sensitive API calls.

The current architecture + what I need to add in orange:

Image of the architecture

*All servers are exposed to the internet.
What I thought to do is:

  1. Limit sensitive API calls by IP
  2. All sensitive API calls will need a secret key (do I need to use HMAC here?) that will be validated on the API server

What do you think? Is there a better way to do this?

  • 2
    Any reason you don't want to use mutual TLS?
    – Crowman
    Oct 11 '20 at 18:07
  • @Crowman I didn't that there is such a thing as mutual TLS, I will look it up. Thanks:)
    – bodeke56
    Oct 11 '20 at 19:43

The simplest solution is to use mutually authenticated TLS. This will only authenticate the communicating parties.

  • What do you think about JWT?
    – bodeke56
    Oct 11 '20 at 21:37
  • 1
    Just to be clear, JWT is a token format. Not an authentication mechanism.
    – Limit
    Oct 12 '20 at 7:37
  • JWT tokens can be used rather than mTLS. However then you will need to be able produce and validate tokens. mTLS should be available out the box.
    – Marinus
    Oct 12 '20 at 11:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.