Tenant isolation under pressure

A customer can fetch an invoice from another account. Keep legitimate customer and support access working while closing the cross-account and cross-tenant paths.

AppSec · about 60 minutes. Fictional evidence; Python 3.10+ for local coding.

Prerequisites

Evidence

request-and-identity.txt

Trusted session: user=bob tenant=acme role=customer active=true
GET /invoices/42?tenant=birch&owner=alice
Invoice 42: tenant=birch owner=alice amount=45
Observed response: 200 with invoice data
Note: query parameters are controlled by the caller.

handler.py

def get_invoice(session, request, store):
    assert session.authenticated
    tenant = request.query.get("tenant", session.tenant)
    invoice = store.find(tenant, request.invoice_id)
    if request.query.get("role") == "billing-support":
        return invoice
    return invoice  # login is the only effective check

access-contract.txt

A customer may read only their own invoice in their trusted session tenant.
A trusted billing-support role may read invoices in that same tenant.
A support role is assigned by the server, never by a query field.
Inactive or unauthenticated identities are denied.
A denial must not return the invoice body.

Tasks and expected evidence

  1. Draw the trust boundary between the authenticated actor and the request fields. Name two distinct authorization failures with evidence-file references.
  2. Edit tenant_invoice in the downloadable exercise. Derive tenant and role from the trusted actor; preserve the owner and authorized support cases.
  3. Run the tenant suite without --reference. Add a proposed endpoint test proving a client cannot spoof the trusted identity before this function is called.
  4. Write a short finding with impact, reproduction, fix, allowed/denied results, and the remaining identity-integration risk.

Run the coding exercise

Download the Python exercise. It uses only the standard library and no network.

python expert_security_lab.py --lab tenant
python expert_security_lab.py --lab tenant --reference

Starter mode initially fails. Edit the matching function and rerun without --reference. Reference mode tests supplied code, not your own fix.

Limits

The Python exercise uses in-memory dictionaries. It does not implement sessions, database queries, HTTP status codes, or a real support approval process.

All expert cases