psycodepath/hrp
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions

Feature: Tenant-Isolated Sessions and Authentication #4

New issue
Closed
opened 2026-06-25 19:30:21 +00:00 by psycodepath · 0 comments
psycodepath commented 2026-06-25 19:30:21 +00:00
Owner
Copy link

Motivation

Authentication and session cookies must be isolated so that a session from one tenant is not valid on another tenant.

Description

Configure PHP session cookie paths/domains to be isolated per tenant subdomain, and partition session variables or user entities by tenant database.

User Story

As a user, I want my session to be valid only on my household's subdomain so that I am not logged into other households.

Gherkin Feature

Feature: Tenant-Isolated Sessions
  As a security-conscious user
  I want my login session to be scoped to my subdomain
  So that other subdomains cannot hijack or share my session

  Scenario: Login is scoped to subdomain
    Given I log in on "family1.localhost"
    When I visit "family2.localhost"
    Then I should be prompted to log in on "family2.localhost"

Acceptance Criteria

  • Session cookie configurations scoped to the tenant-specific host/domain.
  • Logging out of one tenant does not affect sessions on other tenants.
  • Authentication queries map to the active tenant's database.
### Motivation Authentication and session cookies must be isolated so that a session from one tenant is not valid on another tenant. ### Description Configure PHP session cookie paths/domains to be isolated per tenant subdomain, and partition session variables or user entities by tenant database. ### User Story As a user, I want my session to be valid only on my household's subdomain so that I am not logged into other households. ### Gherkin Feature ```gherkin Feature: Tenant-Isolated Sessions As a security-conscious user I want my login session to be scoped to my subdomain So that other subdomains cannot hijack or share my session Scenario: Login is scoped to subdomain Given I log in on "family1.localhost" When I visit "family2.localhost" Then I should be prompted to log in on "family2.localhost" ``` ### Acceptance Criteria - [ ] Session cookie configurations scoped to the tenant-specific host/domain. - [ ] Logging out of one tenant does not affect sessions on other tenants. - [ ] Authentication queries map to the active tenant's database.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
chore/medium-low-hardening
security/tenant-isolation
feature/tenant-aware-auth
feature/tenant-specific-config
feature/issue-11-kernel-json-ld-support
issue/4-sessions-auth
issue/3-migrations
issue/2-database-routing
issue/1-tenant-detection
feature/integrate-behat
feat/csrf-protection
0.3.0
0.2.0
v0.1.0
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
psycodepath
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
psycodepath/hrp#4
No description provided.