Resources · 3 min read
A portal with two clients inside is no longer a website
Showing a client their data is easy. The hard part is that account A can never see a record from B — not by a bug, not by a guessed URL.
The second client changes the problem
While the portal serves a single company, every screen can query whatever it wants: everything in there belongs to whoever is looking. The day the second client arrives, every query needs a prior question — whose record is this? — and that question can't be forgotten even once. It isn't one more feature: it changes how everything that touches the database gets written.
Roles and isolation aren't the same problem
Role permissions decide what a person can do inside their own company: who approves, who only reads. Isolation decides something earlier and harder: which records exist for that company at all. A bad role shows too much to someone in-house; bad isolation shows one client another client's operation. The first is a problem. The second is the end of the relationship.
The filter doesn't belong in the screen
Hiding what isn't yours in the interface isn't isolation: it's decoration. If the record reached the browser, it already left the server, and anyone reading the response can see it. The boundary has to sit where the database is read: every query starts already scoped to the account asking, without exception, and there is no “admin” query that skips the rule for convenience.
The guessed URL
The most common attack isn't sophisticated: someone changes a number in the address and asks for the neighbouring report. If the only thing stopping them was that the button didn't appear on their screen, it works. That's why the check runs server-side and on every request — not at login, not once per session. Every request asks again whose record this is.
What you have to be able to answer
Two questions, the day a client asks them. Who saw what and when, in a log that can't be edited. And what happens to their data if they leave: a complete export and a deletion, on a deadline written down before signing. A portal that can't answer those two isn't ready for a company that audits its vendors.
Rather go through it on your own case?
A 15-minute audit of your real operation. You leave with an honest read on what to automate first, and what to leave alone.
Book a 15-min audit