mTLS vs. HTTP 消息签名：保护 HTTP 请求的权衡
2 分•作者: getvictor•6 个月前
我一直在比较两种认证 HTTP 请求的方法：mTLS 和 HTTP 消息签名（如 RFC 9421）。
mTLS 速度快，由 TLS 层处理，但部署复杂（例如证书、终止）。HTTP 签名在应用层提供更大的灵活性，但需要自定义逻辑和重放保护。
目前，我倾向于使用 HTTP 消息签名，因为它为像我这样的应用开发者提供了更大的灵活性，而且我不需要担心负载均衡器等基础设施。我可以决定哪些 API 端点需要签名，以及请求的哪些部分将被签名。
很好奇其他人都在生产中使用什么。您是如何保护服务或设备之间的请求的？尝试过这两种方法有什么经验教训吗？
查看原文
I’ve been comparing two approaches to authenticating HTTP requests: mTLS and HTTP Message Signatures (like RFC 9421).<p>mTLS is fast and handled by the TLS layer, but has deployment complexity (e.g. certs, termination). HTTP signatures offer more flexibility at the app layer, but require custom logic and replay protection.<p>Currently, I'm on the HTTP Message Signatures train since it provides more flexibility to an app developer like me, and I don't have to worry about infrastructure such as load balancers. I can decide which API endpoints need signatures and which parts of the request will be signed.<p>Curious what others are using in production. How are you securing requests between services or devices? Any lessons from trying both?