Multi-tenant session management: Isolation patterns that actually work

Multi-tenant session management in B2B applications involves complexities beyond single-tenant systems, primarily focusing on how user sessions interact when switching between different organizational contexts. Two main patterns are explored: the session-per-org model, where each organization switch ends one session and starts another, ensuring that session tokens are specific to each organization and thus secure, and the org switching within a single session model, which allows for a single long-lived session with dynamic organization switching, although this places the security burden on application code rather than credentials. Effective multi-tenant management necessitates careful token scoping, refresh token rotation with reuse detection, per-tenant timeout policies, and data layer enforcement of tenant isolation to prevent cross-tenant data leaks. The complexities extend to managing multi-device sessions and ensuring secure transport layers, with additional considerations for tenants with compliance requirements, such as using server-side session storage. Tools like WorkOS can simplify token management, though the application must still rigorously handle the query layer to maintain tenant isolation.