Pull the tenant from the auth context, not the request body
In multi-tenant apps, a common bug is reading tenant_id from the JSON body or query string and then authorizing against that value. Anyone can send tenant_id=other-customer . The tenant for an authorization check must come from the authenticated principal or server-side session — the same place you already trust for user identity — not from client-supplied fields. Pattern: Authenticate the…
We haven't written up this one. Dev.to has the full story — the link below goes straight to it.
