ROT HACKERSACADEMYStart learning
Courses/Authorization by Design/Lesson 03
02.03 / 50 min

Test tenant isolation and ownership

Model tenant membership and resource ownership as different authorization dimensions.

By the endChoose Tenant isolationCompare foreign and same-tenant behaviorAvoid status-only conclusions
Controlled exercise

Use only the Academy Lab on 127.0.0.1:5177. Do not copy these tests to a public system without explicit written authorization.

01

Run the secure tenant matrix

Select User A, User B, and Admin. Choose Tenant isolation and target Tenant B’s secure report.

GET /api/tenants/tenant-b/report
Expected result

User A receives 403; User B and Admin receive 200.

02

Run the vulnerable tenant matrix

Switch to tenants-insecure while keeping the tenant field, candidates, and identities fixed.

GET /api/tenants-insecure/tenant-b/report
Expected result

User A receives Tenant B’s confidential report.

03

Inspect semantics

Confirm the attacker response includes the foreign tenant name and report content. A shared 200 is meaningful because sensitive owner data is present, not simply because statuses match.

MASTERY CHECKPOINT

Prove it before moving on.

The evidence identifies the attacker tenant, target tenant, leaked fields, and the expected secure result.