Guidelines on using django-tenants in a secure manner

Are there any guidelines on using django-tenants in a secure manner?

I can think of at least one issue by which using django-tenants could lead to a security vulnerability. By having 'django.contrib.sessions' in SHARED_APPS, can’t a user in one sub-domain/tenant impersonate a user in some other sub-domain/tenant?

While I am not sure if my guess is correct, we should have a section on security in the documentation and also have checks in the code that will catch insecurely configured projects.

[suriya]

In a recent project, we have auth models in the public tenant and other models in the private ones. We don’t want a user who logically belongs to one tenant to access data in a different one. We have a custom middleware immediately after django.contrib.auth.middleware.AuthenticationMiddleware which raises 403 in case of cross-tenant access.

[tomturner]

@suriya Thanks for pointing this out. Yes it is a problem if you have you session table in your tenant I have proved it on two different projects. I agree we need to document this out. Please do as @kosz85 states and have the session table in each tenant. I will work on the documentation over the next week.