A client portal by token: why every query anchors to the customer

1 November 2026Majed Alandajani

A client portal is a page the client opens through a private link to see their own file: proposals, contracts, invoices.

The mistake to avoid at any cost

One client seeing another client's data.

The way it happens is embarrassingly simple. The page takes an identifier from the URL and queries with it directly, so anyone who edits a digit in that URL lands on somebody else's file.

The rule I applied

The link gets used exactly once, to resolve the customer. From then on the code forgets it existed, and every later query anchors to the customer row that single lookup returned.


customer  = look up by token      ← once
proposals = this customer's       ← nothing from the link
contracts = this customer's
invoices  = this customer's

Tamper with anything in the link and nothing changes: no query reads from it.

The complication I hit

Some of my records carry no direct reference to the customer at all. Contracts and proposals were keyed by email or by order reference, and a customer id appeared nowhere on them.

So I reach those records through what the customer already owns, meaning their orders and their email, and I refuse any association that arrives from the link. Details at this level decide whether the portal holds or leaks.

Constraints on the link itself

The token is long and random, never sequential. Hand out sequential ids and whoever holds one link can try the neighbouring numbers.

It is also revocable and rotatable. Projects end, links leak, and the answer to both is cancelling the old token and issuing a replacement.

And it is erased with the customer's data. If they request erasure and the link survives, an open door remains onto an empty file or onto remnants.

How to be sure

Do not review the code, test it. Open the portal with one client's link and hunt the page for another client's name, or for an order reference that is not theirs. I keep a script that runs this check against production and revokes everything it creates afterwards.