ASP.NET Core Web API Interview Question #192

How should API authorization work in a multi-tenant application?

Senior API Design, Architecture, Scalability & Production Scenarios Senior Advanced

Quick Interview Answer

Tenant identity should come from a trusted authenticated context or validated routing model, not from an arbitrary client field that is accepted without verification. Every tenant-owned query and mutation must enforce the tenant boundary.

Detailed Explanation

Defense in depth can include tenant-scoped repositories, global query filters where appropriate, resource-based authorization, database policies, and tests specifically designed to detect cross-tenant data access.

Code Example

var tenantId = User.FindFirstValue("tenant_id");

var order = await _db.Orders
    .AsNoTracking()
    .SingleOrDefaultAsync(
        x => x.Id == id && x.TenantId == tenantId,
        token);