- Shipped
- August 24, 2026 at 9:40 PM UTC
- Author
- Kamo
- Commit
- ee0a8e5
The guard read the host org's id with /"id"\s*:\s*(\d+)/ -- a bare digit straight after the colon. SecurityService's JsSafeLongSerializer writes any Long above 2^53 as a JSON STRING, and every org id here is a 19-digit unique_rowid() around 1.17e18, so the id always arrives quoted and that pattern matched nothing. hostOrgIdStr was therefore always null, and the comparison sat behind `if (hostOrgIdStr && ...)`, so it never ran. The one cross-tenant check on this route has been inert. Three changes: Accept a quoted id, so the comparison happens at all. Fail CLOSED when the host org cannot be resolved. It previously proceeded "to preserve current behavior", which made the check skippable by anything that could make the lookup fail. Refusing costs a real login; proceeding costs the wrong organization's rights. Skip the comparison entirely on the platform's own host. That host now serves every org without a domain of its own, so resolving it yields KamoCRM Inc. and a session for any other org would look like a mismatch -- refusing exactly the sign-in this work exists to allow. There the signed session names the organization and is the authority; a host that names one tenant still has to agree with it.