Hi,

I've just been looking at this and believe - without testing - that your default implementation is actually prone for SQL injection:

• When configured with the integration Servlet Filter, a http header could be provided,
• this is in turn converted to a Tenant using the DefaultProvider,
• which simply sets the Identity to the provided value.
• The SwitchingDatasource then simply uses getIdentity().toString() as a database name.

DatabaseMetaData.getIdentifierQuoteString() might be a possible candidate for a solution, or at least throw an exception if the databasename contains the quote character.

Best
Philipp

Support this kind of request processing.

See https://docs.spring.io/spring/docs/current/spring-framework-reference/htmlsingle/#mvc-ann-async

Currently database languages are hard-coded into an enum which prevents use of unknown databases or alternative methods of SQL-based database switching. AbstractDatabaseSwitchingDataSource should enable configuration of the SQL to use for switching databases in (for example) a spring configuration. This would enable other database implementations to be used.

I've looked at the code and didn't found anything that made me believe it will work with @async methods. Am I right?

Support an InheritableThreadLocal strategy for tenantyContext just as in Spring Security.