[gabrtv]

> The services are considered to be in a trusted network and are accessed by a private token passed in the ‘Authorization' header plus the user id of the requester in an ‘X-USER’ header.

This reads like the user ID is exposed in a header without any sort of encryption.

[adaml_623]

What does 'trusted network' mean to you?

A lean quick service is not going to want to wait on encryption handshaking.

[wtbob]

On modern hardware, I believe AES and SHA-384 are very cheap. But yes, in a private network it's overhead.