In multi-tenant apps, a common bug is reading tenant_id from the JSON body or query string and then authorizing against that value.
Anyone can send tenant_id=other-customer. The tenant for an authorization check must come from the authenticated principal or server-side session — the same place you already trust for user identity — not from client-supplied fields.
Pattern:
- Authenticate the caller.
- Resolve their tenant (or list of tenants) from the token/session/membership store.
- Authorize the action for that tenant and resource.
- Ignore or reject a client-supplied tenant that does not match the resolved one.
Treat client tenant_id as a filter preference at most, never as proof of tenancy.
