Authentication, Authorisation and Multi Tenant Isolation

Authentication Fundamentals

Authentication confirms user identity through credentials such as usernames and passwords, biometrics, or tokens. In practice, many applications implement basic authentication using username/password combinations. However, these systems often lack proper validation and error handling. A common vulnerability occurs when applications provide different error messages for incorrect usernames versus incorrect passwords. Attackers can exploit this by enumerating valid usernames through timing differences or distinct error responses.

• Implement consistent error messaging for authentication failures
• Use strong password policies including minimum length, complexity requirements, and regular updates
• Apply rate limiting to prevent brute force attacks on authentication endpoints
• Ensure authentication systems validate input parameters properly

Consider a banking application that authenticates users through a web form. The system should respond identically whether a user enters a non-existent username or a correct username with an incorrect password. This prevents attackers from determining which usernames exist in the system. The authentication flow must also validate that submitted data matches expected formats and lengths to prevent injection attacks.

Authorisation Controls

Authorisation determines what authenticated users can access within an application. The principle of least privilege requires users to have only the minimum permissions necessary for their role. In multi-tenant applications, this becomes particularly important as data isolation must prevent users from accessing information belonging to other tenants.

Many applications implement role-based access control through user roles such as admin, manager, or employee. These roles should map directly to specific functions rather than broad categories. For example, an admin role might grant access to user management, system configuration, and audit logs, while a manager role might allow viewing reports and approving requests. The system must validate these permissions at every access point rather than assuming they remain static.

• Implement explicit permission checks for every data access operation
• Use attribute-based access control for complex data access scenarios
• Regularly audit access controls and remove unnecessary permissions
• Ensure authorisation decisions are made at the application level, not client-side

A healthcare records system demonstrates proper authorisation implementation. Nurses can view patient records but cannot modify them, while doctors have full read-write access. The system must verify these permissions each time a user attempts to access or modify data. If the application allows client-side JavaScript to determine access rights, attackers can bypass these controls by modifying the client-side code.

Multi-Tenant Data Isolation

Multi-tenant applications serve multiple organisations or users from a single instance. Proper data isolation prevents cross-tenant data leakage. The isolation must be enforced at multiple levels including database queries, API endpoints, and application logic.

Database-level isolation involves using tenant identifiers in every query. A common mistake occurs when developers forget to include tenant filters in queries or use string concatenation that makes queries vulnerable to injection. The application must ensure that every data access operation includes the correct tenant identifier. This identifier should come from the authentication context rather than user input.

• Always include tenant identifiers in database queries
• Implement database views or schemas to separate tenant data
• Validate tenant ownership before allowing data access
• Use parameterised queries to prevent injection attacks

A cloud-based project management tool serves multiple companies through a single application instance. Each company’s projects, tasks, and user data must remain completely separate. The tool must verify that a user from Company A cannot access projects belonging to Company B. This validation must occur at the database level through proper filtering, at the API level through authentication headers, and at the application level through access control checks. The system should also log access attempts for audit purposes.

Implementation of these controls requires careful attention to data flow through the entire application stack. The authentication system must properly validate credentials and establish user context. The authorisation layer must verify that this context allows access to requested resources. The multi-tenant isolation layer must ensure that data access remains properly segmented. All these components must work together to prevent unauthorised access while maintaining usability for legitimate users.