From 4965a3424e413ea0d23b6d8f415a32b7d54c797a Mon Sep 17 00:00:00 2001 From: Tao Chen Date: Tue, 7 Jul 2026 16:32:49 -0700 Subject: [PATCH 1/2] Add multi-tenant hosting hosting security consideration to a2a sample --- python/samples/04-hosting/a2a/README.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/python/samples/04-hosting/a2a/README.md b/python/samples/04-hosting/a2a/README.md index 803bab3f9e5..7b9df4c5938 100644 --- a/python/samples/04-hosting/a2a/README.md +++ b/python/samples/04-hosting/a2a/README.md @@ -79,3 +79,16 @@ cd python/samples/02-agents/a2a $env:A2A_AGENT_HOST = "http://localhost:5001/" uv run python agent_with_a2a.py ``` + +## Security considerations for multi-tenant hosting + +The default `a2a-sdk` task/push-config stores scope ownership by `user_name` only. **Any host that mounts tenant-bearing routes must pass a tenant-aware `owner_resolver`** to the stores, e.g.: + +```python +from a2a.server.tasks import InMemoryTaskStore + +def resolve_tenant_user_scope(context): + return f"{context.tenant}\x00{context.user.user_name}" + +task_store = InMemoryTaskStore(owner_resolver=resolve_tenant_user_scope) +``` From 40a6bd84e79ff14ba17197327dce6ba3f8b478a5 Mon Sep 17 00:00:00 2001 From: Tao Chen Date: Tue, 7 Jul 2026 17:10:13 -0700 Subject: [PATCH 2/2] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- python/samples/04-hosting/a2a/README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/python/samples/04-hosting/a2a/README.md b/python/samples/04-hosting/a2a/README.md index 7b9df4c5938..c187e55b61d 100644 --- a/python/samples/04-hosting/a2a/README.md +++ b/python/samples/04-hosting/a2a/README.md @@ -88,7 +88,7 @@ The default `a2a-sdk` task/push-config stores scope ownership by `user_name` onl from a2a.server.tasks import InMemoryTaskStore def resolve_tenant_user_scope(context): - return f"{context.tenant}\x00{context.user.user_name}" - + # Derive tenant + user identity from your host's auth/session context. + return f"{context.tenant}:{context.user.user_name}" task_store = InMemoryTaskStore(owner_resolver=resolve_tenant_user_scope) ```