I'm looking to implement a gRPC service in .net core, the client would also be in .net core running as a service. The client service will only be installed by my team and the installer package will not be available publicly (and wouldn't be much use to anyone else). I would like advice on whether call credentials (JWT bearer tokens) and/or channel credentials (client certs) would improve security, and if so how/why.
I know this question isn't about specific code, however it may well help determine how the service is coded, so if this is posted in the wrong place then please advise on the correct place.
The purpose of this service is only to receive information from clients, none of which is sensitive, mostly just health info of the endpoint. The server service will be using TLS with a LetsEncrypt certificate. As the connection will be encrypted the identity of the server should be ensured and no nefarious players should have visibility of the data transferred. The clients will only be sending data (to identify the endpoint) that contains a serial number generated by my team at the time of install, and if this somehow got duplicated the wrong data wouldn't really cause any issues or data breaches only that there would be some remediation work by a team member to correct the issue.
Because of these reasons, I can't see what benefit call or channel credentials would offer, especially channel credentials with the added overhead of maintaining client certificates for each client.
Can you offer any thoughts on this, or if there are any other security concerns I should consider?
Also, with this sort of set up, is there anyway a 3rd party could access the server service if they don't have the proto files?
Thanks