Designing Secure Multi-Tenant Applications in PHP
Where should tenant boundaries be enforced in a PHP application? Follow the boundary through requests, queries, jobs, files and recovery.
Start with the tenant, not the login screen
A valid login answers who is using the application. It does not establish which customer’s records that person may access. Before building shared data operations, decide what a tenant represents: a customer account, for example, with its own workspaces and members. A user may belong to more than one workspace, but selecting a workspace must not create a membership they do not have.
Consider a hypothetical regional operator requesting an assessment export. Can they export every assessment for the customer, or only those within their region? We would settle that question before designing the export endpoint. The application needs to validate the current account, tenant membership, permitted operation and organisational scope. Hiding an export button does not enforce those conditions when someone requests the endpoint directly.
Carry the boundary through the data path
Resolve tenant context from trusted server-side membership, then constrain record access consistently. Follow that context through joins, search indexes, file storage, caches and background jobs. A cache entry keyed only by a report name can cross a boundary even when the original database query was correct.
For the assessment export, walk through these checks:
- Verify the operator’s membership in the selected customer account and permission to export the requested region.
- Restrict the assessment lookup to that tenant and authorised region. A supplied assessment identifier alone does not establish access.
- Carry the verified tenant context into the queued export. When the worker starts, recheck permissions that may have changed while it waited.
- Associate the finished file with its tenant and check access again when someone requests the download.
Test an ordinary account requesting another tenant’s record identifier. Also test bulk exports, missing tenant context, suspended membership and a job submitted before a role change. For the example above, remove the operator’s export permission while the job is waiting, then check what the worker does. Agree the expected refusal and confirm that no downloadable export is released to that operator.
Keep session security and authorisation distinct
PHP session configuration, cookie protections and session rotation support account security. They do not replace record-level permission checks. Review session settings against the deployed environment and recheck consequential operations when an account’s permissions change.
With logical isolation, tenants may share infrastructure while the application enforces separation. Separate databases or infrastructure introduce other boundaries, along with additional provisioning and recovery work. You still need explicit authorisation in either design.
Include recovery in that choice. If a backup holds several tenants, rehearse restoring one without exposing the others, and reapply current access rules rather than reviving old memberships from the backup.
A practical design review
Bring one real workflow to the review: the request, the records it reads, any queued work and the file or response it produces. Draw the path and write the tenant and permission check beside each step. Include what happens after the browser session ends. This gives your team something specific to inspect beyond a demonstration where every user has the expected permissions.
Use the PHP session-management manual for session configuration and the OWASP multi-tenant guidance for a broader boundary review. These are design references, not evidence that a particular client system has been independently certified.
Apply this to your project
Explore multi tenant business platforms and the related anonymised project account. If you are planning a review, bring an export or background task and the membership rules it should follow. Discuss your implementation question.
Planning guidance from Webvelopment Editorial. Confirm platform requirements and project assumptions before committing budget.
Keep the right things connected.
Multi-Tenant Business Platforms
Build shared business applications with explicit tenant boundaries, configurable workflows, hierarchical permissions and maintainable administration.
Engineering an Enterprise Energy Data Orchestration Platform
A confidential European energy project connecting operational records, tenant workspaces, permissions, document workflows and reporting in a PHP application.
Start a conversation
Tell us what you are working towards. We’ll help you find a practical next step.