Pull the tenant from the auth context, not the request body

In multi-tenant apps, a common bug is reading tenant_id from the JSON body or query string and then authorizing against that value. Anyone can send tenant_id=other-customer. The tenant for an authorization check must come from the authenticated principal or server-side session — the same place you already trust for user identity — not from... Weiterlesen