Multi-Tenant Apps Should Derive Tenant Context from User Identity, Not Requests

A common security flaw in multi-tenant SaaS applications involves resolving the active tenant from client-controlled inputs such as subdomains or HTTP headers, rather than from the authenticated user's organization membership. This approach makes the client the source of truth for tenant scoping, creating a risk that users could access data belonging to tenants they are not part of. The recommended fix is to derive tenant context exclusively from the authenticated user's server-side organization record inside a dedicated middleware, rejecting requests with no valid organization with a 403 error. This ensures tenant resolution fails closed — meaning access is denied rather than guessed when context is missing. A single automated test that verifies a user cannot be scoped to a foreign tenant, regardless of request headers, is advised to prevent silent regressions.