TLS only cares about the security of the socket. It doesn't know anything about the content flowing through the socket. Additionally the TLS connection may not even be between the server and client but a proxy between the server and client, client and server, or both server and client. While TCP and TLS can get a message over the Internet correctly and securely they can't make any guarantees about the contextual validity of that message.
TLS does not obviate application layer checks it can only compliment them.
I cannot envision a problem that a checksum in the HTTP protocol would fix that TLS wouldn't also fix.
You have to ask yourself "How would this get corrupted"? If the concern is that the data ends up somehow mangled from an external source like a bad router or a lose cable, then the data simply won't decrypt correctly and you'll end up with garbage.
So that leaves you with an application bug. However, an app is just as likely to add a checksum for an invalid body as they are to add one for a valid body.
So, the only fault I could see this fixing is an application which, through corrupt memory or something else, manages to produce a garbage body which fails it's checksum but... somehow... is encrypted correctly. I've never seen that sort of problem.
> TLS only cares about the security of the socket. It doesn't know anything about the content flowing through the socket.
Not sure what that means precisely, but if you're stretching definitions that far, the same is probably also true of your application checksums/hmacs
> Additionally the TLS connection may not even be between the server and client but a proxy between the server and client, client and server, or both server and client.
So its the same as your hmac check. That can also be processed at any layer.
> While TCP and TLS can get a message over the Internet correctly and securely they can't make any guarantees about the contextual validity of that message.
Can anything at the http protocol layer provide that?
TLS does not obviate application layer checks it can only compliment them.