保护多租户SaaS应用程序

Question

I'm multing a multi-tenant SaaS web-application in Java, Spring, Struts2 and Hibernate. After a bit of research, i choose to implement multi-tenancy in a shared db, shared schema, shared table approach. And tagging each db-line with a tenantId.

I have rewritting my application, so Managers and Dao's will take the tenantId as a parameter to only serve the correct db-resources.

This works perfect for all view's when getting information. And also for creating new stuff (using the logged in users tenantId to store the info).

However, for updating and deleting stuff I am not sure how to secure my application. For example: When a user want to edit an object, the url will be: /edit?objectId=x And this is mapped to an action that will retrieve this object by Id. Meaning any logged in user can by url-modification view any object. This i can solve by adding the tenantId to the Dao so if the User tries to view an object outside his tenancy he will get nothing.

Ok thats ok then, but about when sending in the edit-form? What if the user modifies the request, messing with the hidden field objectId so the action will receive a request to alter an object not belonging to the users tenancy.

Or if the users url-modifies a delete action /delete?objectId=x

Basicly I need some way of assure that the logged in user has access to whatever he is trying to do. For all get's its easy. Just putting the tenantId in the where clause. But for updates and deletes i'm not sure what direction to go.

I could query the db for every update and delete to see if the users has access to the object, but i'm trying to keep db-interaction to the minimum. So i find it impractical to make an extra db-call for every such action.

Does anyone have any hints or tips to my issues?

Answer 1

The same for reading applies to writing/updating: user can only see/access/change what they own. Your question is more about database that about anything else. The same constraints you apply to viewing data must also apply to writing data.

In this case, you don't want to wear the performance of a query first then an update. That's fine, since you can update the database with conditions. Since this seems likely to be database-level in your case you need to know what your database is capable of (to do it in one go). For example, oracle has the merge statement.

Answer 2

I am quite late to this thread and maybe you have already built the solution you were asking here about. Anyway, I have implemented a database-per-tenant multitenant web application using Spring Boot 2 and secured the web access using Spring Security 5. The data access is via Spring JPA (with Hibernate 5 as the JPA provider). Do take a look here .