title: Do we need a security signature for the web service response?
body: <p>I have created a web service API and it's architecture is such that the server requires a client to sign the request along with a secret key assigned to it (signature is always different between multiple requests). </p>
  
  <p>Server matches the client's signature with its own computed signature. If they are a match then the server returns the response.</p>
  
  <p>I am wondering if a client should check the response coming back from the server to see if it's from the same application to which the request was made.</p>
  
  <p>Is any kind of attack possible between HTTP request and HTTP response?</p>