Merge pull request #654 from TeskaLabs/feature/no-tenant-in-both-path…

…-and-query

Disallow using `tenant` parameter in path and query at the same time

asab/web/tenant/utils.py

@@ -98,6 +98,10 @@ async def _tenant_context_from_url_path_wrapper(*args, **kwargs):
 		request = args[-1]
 		tenant = request.match_info["tenant"]
 
+		if "tenant" in request.query:
+			L.warning("Parameter `tenant` cannot be present in URL path and query at the same time.")
+			raise aiohttp.web.HTTPBadRequest(reason="Tenant query parameter not allowed.")
+
 		if not tenant_service.is_tenant_known(tenant):
 			L.warning("Tenant not found.", struct_data={"tenant": tenant})
 			raise aiohttp.web.HTTPNotFound(reason="Tenant not found.")