WIMSE Workload-to-Workload Authentication — draft-ietf-wimse-s2s-protocol#
IETF 123 (Madrid) digest Program Core pick Madrid · 19–25 July 2025
- Tier: Core
- Why: The atomic unit of the whole architecture: how two workloads verify each other for a single HTTP request/response. It directly addresses the "do I use mTLS or app-layer tokens?" question that every service-mesh and zero-trust deployment hits.
- What: Defines two compatible protocols — one at the application layer, one riding trusted TLS transport — that can be mixed within a single call chain. (from abstract only)
- How: Workload A → B can use mutual TLS while B → C authenticates at the application level; the two are interoperable across hops, so you don't have to pick one model estate-wide.
- Where applicable: General; aimed at service-to-service traffic in mixed environments where some hops terminate TLS at proxies/load balancers and some are end-to-end.