AsyncLocalStorage Does Not Enforce Tenant Access; Membership Checks Are Still Required

A technical article argues that AsyncLocalStorage, which propagates request context in Node.js, cannot serve as a security boundary for multi-tenant applications. Using a hypothetical scenario with synthetic users, it shows how a caller could select another tenant's identifier, and context propagation would still work while exposing the wrong data. The author stresses that authentication, membership-based authorization, context propagation and enforcement at data access are distinct steps that must each be handled. The experiment ran on Node.js 22.18.0, NestJS 11.1.6 and TypeScript 5.9.2, with reported passing tests and type checks. The article also notes that its demo authentication is only an instructional shortcut and that real permissions may require role or resource-level checks beyond tenant membership.