Two companies, two users called 123, one cache key

transcript

Tenant B opens user 123's profile. It loads instantly. From the cache. And it's Tenant A's user 123.

Tenant A loads its own user 123. The cache key is just user, then the ID. Moments later, Tenant B asks for its own user 123. Same key. Cache hit. Tenant B gets Tenant A's user.

IDs repeat across tenants. So the keys collide. But we have row-level security! It protects the database. Not the cache.

The broken key: user, then the ID. The fix: tenant first. Tenant, its ID, then user, then the ID. Now Tenant A's 123 and Tenant B's 123 are two different keys.

And it's not just the cache. Every store needs the tenant. The search index is per tenant. Every log line carries the tenant ID. Not the user's email.

Row-level security guards one door. The cache is another. IDs can repeat across tenants. Keys can't. Prefix every one with the tenant.

Full breakdown in the lecture.