Securing Multitenant Databases with Entity Framework Core
summary
Shows how Entity Framework Core queries leak tenant data when application code omits owner constraints, demonstrates three approaches: ad hoc per-query where clauses that are easy to forget, global query filters that secure reads but fail when an entity needs multiple security models (example: view-as-friend vs full ownership), and a robust per-request wrapper pattern that injects compiled filter expressions, enforces checks on find/add/remove, and logs breaches. Includes concrete code, interfaces mirroring DbContext, and a working demo proving unauthorized reads/deletes are blocked.
AI-written summary · about
chapters (4)
related talks
57mA practical look at security and identity in ASP.NET Core and Entity Framework Core
46mHow to Build a Multi-Tenant ASP.NET Core Application
01h 00mGetting the best out of Entity Framework Core
59mMapping DDD Domain Models with EF Core 2.1
46mDatabase-Per-Tenant Architecture Using .Net Core and Azure SQL Database
01h 04mCommon mistakes in EF Core
46mMapping Well-Designed Domain Models with EF Core 2.1
01h 02mUnlocking the Full Potential: The Harmonious Dance of EF Core and SQL Server