Intermediate LevelREST APIs & Web Services
How do you implement Multi-Tenant routing via subdomains vs header paths?
❓ Interview Prompt: Compare Multi-Tenant API isolation patterns: Tenant Subdomains (`tenant1.api.com`), Path Prefixes (`/tenants/tenant1/`), and Tenant Headers (`X-Tenant-ID`).
Multi-Tenant SaaS API architectures isolate client data while sharing infrastructure:
1
Subdomain Isolation ('tenant.api.com'): Highly secure, supports tenant-specific TLS certificates and CDN rules.
2
Custom Header ('X-Tenant-ID: tenant_123'): Easy for mobile apps, but requires middleware validation on every request to prevent tenant data leaking.
3
Database Isolation: Middleware sets tenant context in database connection session context ('SET app.current_tenant = 'tenant_123'') to enforce Row Level Security (RLS).
Code Implementation Example
typescript
import { Request, Response, NextFunction } from 'express';
export function tenantMiddleware(req: Request, res: Response, next: NextFunction) {
const tenantId = req.header('X-Tenant-ID') || req.hostname.split('.')[0];
if (!tenantId) return res.status(400).json({ error: 'Missing tenant context' });
// Attach tenant context to request execution scope
req.tenantId = tenantId;
next();
}💡Extracting and enforcing tenant context in API gateway middleware.
🎯 Interview Key Takeaway
Enforce multi-tenant data isolation by extracting tenant context in middleware and enforcing Row Level Security in database queries.
#Multi-Tenancy#Isolation#SaaS#Intermediate
Back to all REST APIs & Web Services Questions→