Tenant A's JWT must not authorize Tenant B's API paths even when ob…

Question

Tenant A's JWT must not authorize Tenant B's API paths even when object IDs are guessable. Beyond verifying the JWT signature, what must the API enforce?

Accepted Answer

Combine trusted token claims (such as tenantId) with server-side tenant checks on every data access — A valid badge for Building A does not open Building B's records room. Check the tenant claim on the token and re-check tenant ownership on every query — guessable IDs are not a security boundary.

Answer

Accept any signed JWT from Cognito and authorize solely by whether the object ID looks random

Answer

Skip claim checks when the caller uses HTTPS because TLS already isolates tenants

Answer

Map all tenants to one IAM role with dynamodb: so authorization stays in the network layer

Tenant A's JWT must not authorize Tenant B's API paths even when object IDs are guessable. Beyond verifying the JWT signature, what must the API enforce?

Short Explanation

Full Explanation