Is Your App Naked Online? Why it Needs mTLS

I know the title is little clickbaity 😛 but the word “naked” is a powerful metaphor here. It means:

• Exposed
• Unprotected
• Vulnerable
• Lacking a essential layer of defense

In the context of web security, an app is “naked” if it’s only using standard TLS/HTTPS (the padlock in your browser).

Wait, isn’t HTTPS enough? For a user-facing website, HTTPS is fantastic. But for communication between your own services (e.g., your frontend server talking to your payment API, or one microservice talking to another), HTTPS alone has a critical weakness:

HTTPS only authenticates the server. The client (e.g., your frontend server) verifies it’s talking to the real backend API. But the backend API blindly trusts that any client that connects is authorized to do so.

It’s like a nightclub where the bouncer first proves it’s a legitimate club by showing you its license, but then lets anyone inside without checking their ID.

The Problem We Ran Into

Not long ago, while working on a data processing application, we had to deploy part of our stack (dataplane) inside our customer’s AWS environment. The rest of the system — our APIs, orchestration logic…