Search code examples
api.net-coremulti-tenanthttp-status-codeswebapi

Set http status code to 417 when request API with wrong custom header

I have an API (based on dotnet core 5 if it matters) that supports multi tenancy. all requests must have a custom header (like X) that indicates the selected tenant. So based on this scenario I have two main questions.

  1. Is it true to accept tenant via header? (any security consideration or another suggestion would be appropriate)
  2. Is it true to return HTTP status code 417 when clients request a tenant that does not exist or is not valid?
Solution

    1. Yes, it is okay to accept the tenant via header. As far as security is concerned, it depends on your security mechanism to restrict access to the API.

    2. As par RFC 7231, the status code 417 has more to do with Expect header. If the tenant does not exist, 401 - Unauthorized would be more suitable, and a 403 - Forbidden if it's a valid tenant but doesn't have the privilege to perform the operation.