Skip to content

fix(security): reject tenant :id param vs x-tenant-id header mismatch#188

Merged
chitrank2050 merged 3 commits into
mainfrom
fix/140-security-tenant-id-param-vs-x-tenant-id-header-mismatch
May 23, 2026
Merged

fix(security): reject tenant :id param vs x-tenant-id header mismatch#188
chitrank2050 merged 3 commits into
mainfrom
fix/140-security-tenant-id-param-vs-x-tenant-id-header-mismatch

Conversation

@chitrank2050

@chitrank2050 chitrank2050 commented May 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Owner
  • Controller-level guard on findById, update, and remove
  • Compare @Param('id') against @TenantID(), throw 403 on mismatch
  • Add ERRORS.TENANT.ID_MISMATCH constant
  • Prevents cross-tenant mutation via URL param manipulation

Closes #140

@chitrank2050 chitrank2050 self-assigned this May 23, 2026
@chitrank-actions chitrank-actions Bot added area/docs Documentation files and markdown files area/logic Application source code changes labels May 23, 2026
@chitrank2050
chitrank2050 merged commit 8594e08 into main May 23, 2026
11 checks passed
@chitrank2050
chitrank2050 deleted the fix/140-security-tenant-id-param-vs-x-tenant-id-header-mismatch branch May 23, 2026 02:40
@chitrank-actions chitrank-actions Bot mentioned this pull request May 23, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@chitrank2050 chitrank2050

Labels

area/docs Documentation files and markdown files area/logic Application source code changes

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

fix(security): tenant :id param vs x-tenant-id header mismatch

1 participant

@chitrank2050