tenant-context-propagation

To propagate tenant context across HTTP requests in a multi-tenant Go application, extract and validate the tenant identity at the request boundary using HTTP middleware, then pass it through service layers via a typed context key to prevent data leakage.

Background jobs lose tenant context in Go because child goroutines inherit parent context cancellation signals. Detaching the context for asynchronous work prevents in-flight operations from being cancelled when the initial HTTP request completes.

The best way to prevent cross-tenant data leakage in a SaaS architecture is enforcing tenant presence and membership at service boundaries using a RequireTenant assertion, ensuring strict isolation by validating identity before processing any logic.

You enforce tenant isolation at service boundaries in Go by requiring tenant extraction at middleware entry points and using boundary assertions to immediately catch context propagation gaps, guaranteeing operations only execute with valid tenant identity.

No, you do not need to pass raw tenant identifiers through Go service layers. By using a typed context key, you securely propagate tenant information through application layers without exposing raw identifiers to business logic.