A common authorization bug: the API takes tenant_id from the request body or query string, then loads that tenant’s data if the user is authenticated.
Authentication only proves who you are. It does not prove which tenant you may act in.
Better pattern:
- Resolve the caller’s allowed tenants from a server-side session, token claim you issued, or membership store.
- Ignore or strictly validate any client-supplied tenant against that set.
- Scope every query with the authorized tenant — never with the raw client value alone.
If the client can pick any tenant ID, they can often read or mutate another customer’s data. That is an IDOR wearing a multi-tenant costume.
Teach the check: “is this principal allowed for this tenant?” — not “does this tenant exist?”
