Protect Tenant Detail Links
Ensure direct record links enforce current membership, even when a user saved the URL earlier.
A link to a record is not a grant. A user may bookmark it before leaving an organization, receive it in an email, or paste it into another browser. The detail handler must make a fresh access decision for the current caller and record. OWASP Authorization advises checking access at the resource rather than relying on navigation or client state.
Build a deep-link decision table
Choose one synthetic tenant record and list the ways a link can be opened. Record the expected decision for each case.
| State at request time | Expected behavior |
|---|---|
| Current member with read permission | Return approved fields |
| Member whose role lost read permission | Deny |
| Former member with an old bookmark | Deny |
| Member of a different tenant | Deny without record content |
| Anonymous caller | Require authentication; do not reveal private data |
| Deliberately public record | Apply its separate public-read rule |
Run the table against HTML page load, client-side navigation, API fetch, and prefetch if the application uses it. A server-rendered page can leak content before a client-side guard redirects. A prefetch can cache data even when the visible page later denies access. Check logs and previews for unnecessary private fields, but keep tests in an owned environment.
Use stable, opaque IDs where appropriate, yet do not confuse unguessable IDs with authorization. Someone can obtain a valid link from an authorized user. The handler still needs a rule based on current identity, membership, resource owner, and action. If a public link is a product feature, model it as an explicit capability with scope and expiry rather than a universal bypass.
Check saved and prefetched links
Illustrative fixture: save /projects/A7 while an A member can read it, then remove that membership. A direct HTML load and the application's actual prefetch request must both return no A7 title, body, or serialized state. Inspect the network response and any client cache before navigation; a later redirect does not erase bytes already delivered. A current A member remains the positive control. If the framework has no prefetch path, record that absence rather than inventing a test result.
Keep status-code policy separate from access policy. A 404 can conceal existence; a 403 can help a legitimate user understand a lost grant. Either can be acceptable when no data leaks and clients behave correctly. The OWASP API Top 10 highlights object-level authorization. This guide's artifact is the saved-link state table, including revocation. A green test for a new link does not cover an old bookmark.
Find the gaps in your access controls
See how an illustrative cross-workspace finding connects evidence, impact and a fix. Discuss the tenant boundaries your team needs reviewed.
Sources
- OWASP Authorization Cheat SheetAccessed
- OWASP API Security Top 10 (2023)Accessed