Sourced / Security blog
Tenant Isolation & API Authorization
Website, API and AI security. Clear scope, useful evidence, and practical fixes.
63 articles / Page 1 of 3
- Tenant Isolation & API Authorization
Audit PostgreSQL RLS Bypass Roles
Find roles and execution paths that can read past PostgreSQL row security.
- Tenant Isolation & API Authorization
Audit Tenant Access Changes
Record tenant access grants and removals without logging secret values.
- Tenant Isolation & API Authorization
Audit Tenant Filters on List APIs
Trace list queries and test that each response contains only records the caller may see.
- Tenant Isolation & API Authorization
Authorize Each Batch API Operation
Check every item in a batch request against the caller's role and tenant.
- Tenant Isolation & API Authorization
Authorize GraphQL Node Lookups
Enforce object ownership when a GraphQL node ID resolves to a tenant record.
- Tenant Isolation & API Authorization
Authorize Nested GraphQL Fields
Apply tenant and field permissions inside nested GraphQL resolvers.
- Tenant Isolation & API Authorization
Authorize Tenant Webhook Subscriptions
Check who may create or change an outbound webhook subscription for a tenant.
- Tenant Isolation & API Authorization
Bind Queue Messages to Tenants
Validate tenant and resource ownership at both ends of a queue.
- Tenant Isolation & API Authorization
Block Sensitive Field Mass Assignment
Allow only approved input fields when an API creates or updates a record.
- Tenant Isolation & API Authorization
Bound API Replay Windows
Set a clear validity window and duplicate policy for signed API requests.
- Tenant Isolation & API Authorization
Budget API Rate Limits per Tenant
Separate tenant, user, and global API limits so one customer cannot exhaust another.
- Tenant Isolation & API Authorization
Build a Tenant Authorization Matrix
Define allowed and denied actions for each role, resource, and tenant relationship.
- Tenant Isolation & API Authorization
Carry Tenant Context Into Async Jobs
Bind each background job to a trusted tenant and recheck permission before sensitive work.
- Tenant Isolation & API Authorization
Check Tenant Notification Recipients
Verify that each notification reaches only current, authorized recipients.
- Tenant Isolation & API Authorization
Check Tenant Scope in SQL Joins
Review joins between tenant-owned tables and test mixed-tenant identifiers.
- Tenant Isolation & API Authorization
Choose API Denial Responses
Choose 401, 403, or concealed 404 responses without leaking private resource details.
- Tenant Isolation & API Authorization
Constrain Tenant Admin Overrides
Define narrow, logged exceptions to normal tenant authorization.
- Tenant Isolation & API Authorization
Control Support Impersonation
Require a named, narrow, time-limited support grant and an audit trail for every action.
- Tenant Isolation & API Authorization
Design Synthetic Tenant Test Fixtures
Build safe test records that reveal both cross-tenant leaks and false denials.
- Tenant Isolation & API Authorization
Design a Tenant Role Permission Map
Translate tenant roles into explicit resource and action decisions.
- Tenant Isolation & API Authorization
Expire Tenant Signed Downloads
Set issue, use, expiry, and revocation rules for signed tenant file links, then verify them at storage and edge.
- Tenant Isolation & API Authorization
Fix BOLA on Record Endpoints
Move record ownership checks into each API operation and test both allowed and denied access.
- Tenant Isolation & API Authorization
Fix OAuth2 Security Scheme Codegen
Trace OAuth2 security schemes into a generated client and deny calls when the token is missing.
- Tenant Isolation & API Authorization
Gate Admin API Functions
Verify role checks on privileged API functions, not only on admin screens.