EF Core Interceptors for Secure, Per-Tenant Audit Logging
TL;DR In multi-tenant SaaS, generic audit logging can easily leak data between tenants. This is a security and compliance nightmare. Overriding DbContext.SaveChanges() is a common but clunky solution that tightly couples auditing logic to your data context. EF Core Interceptors provide a clean, decoupled way to hook into the save process and add per-tenant audit logs automatically. The solution involves creating a SaveChangesInterceptor, grabbing the current TenantId from a scoped service, and logging entity changes before they hit the database. This pattern is perfect for auditable, compliant SaaS applications but might be overkill for simple, single-server projects. I once got a panicked call about a critical bug. An admin from “Company A” could see user creation events from “Company B” in their audit trail. It was a classic multi-tenant data bleed, but not in the main application data—it was in the logs. This is one of those sneaky bugs that passes all unit tests but can absolutely destroy trust with your customers and fail a compliance audit. ...