Engineering
Serving many organisations from one deployment.
We found the same hole twice, in two systems written a year and a half apart by people solving unrelated problems. Neither was a subtle cryptographic mistake. Both were the same sentence, written twice: The browser told us which organisation this request is for, and we believed it.
This site is served at two addresses: Same words, same pages, same build inputs. Only the branding differs — and, less obviously, the path everything is mounted at.
An organisation's address serves three separate applications: They are three builds, from three directories, with three bundles. They share a domain, a session and a design system,…
Every organisation on the platform gets its own address and its own branding. The obvious way to build that is to fetch the branding when the app starts. We did, and it was wrong i…
