Web Security · Middle · Question 62 of 75

A multi-tenant SaaS filters data by `tenantId` from the request body. What's the risk?

1No risk, the body is validated by JSON schema
2Only performance is affected
✓Correct answer: A user can change tenantId and read another customer's data; the tenant must come from the authenticated session

Explanation

Identity and tenant should be derived from the token or session on the server, never trusted from user input.

Further reading

Test yourself

Take the Web Security · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.