When we use mTLS, then client and server are authenticated. In this scenario, does it make any sense to send HTTP requests in signed tokens (like JWS)?

2 Answers 2


TLS only protects the specific communication between client and server and the authentication is also only restricted to this communication. If messages are forwarded to some backend or stored in a database, then the final receiver of the message can only trust the server that it properly checked the client with mTLS, but it cannot do this check itself.

Only if each message itself is separately signed by the sender and the signature is forwarded together with the message, then the final recipient can verify the origin of the message. TLS/mTLS do not provide this - it only provides authentication at the beginning and then integrity protection for all messages - but not signing of the messages.


First you should decide what is the purpose of the token. Do you authenticate users based on the token or based on the client certificate? In the first case you don't need client certificate for authentication. Ind the second case you don't need token for authentication.

If you use token for authorization, then client certificate does not matter.

JWT is signed not by the client and not by the server that is called, but by an authentication server. The service that you call checks JWT token. For this, it must be signed. It does not matter at all, if the whole way between client and the service is encrypted with TLS or if there are unencrypted parts, e.g. behind the TLS termination point. The service can trust the token only if it is signed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.