Why Multi-Tenant Apps Should Never Trust Client-Supplied Tenant IDs

A common security flaw in multi-tenant applications involves reading the tenant identifier directly from the request body or query string, which allows any user to impersonate another tenant by simply altering the value. The correct approach is to resolve tenant identity from the authenticated token, server-side session, or membership store — the same source already trusted for user identity. Developers should authenticate the caller first, then derive their associated tenant from trusted server-side data before authorizing any action. Any client-supplied tenant ID that does not match the server-resolved value should be ignored or rejected outright. At most, a client-provided tenant ID should be treated as a filter preference, never as proof of legitimate tenancy.