How do you safely read a tenant id from r.Context() inside an http.Handler?

## What the read actually returns `context.Context`'s lookup method has this shape: ```go Value(key any) any ``` It is untyped in both directions. Asking a context for a key walks the chain of derived contexts toward the root and hands back whatever was stored, as `any`. If no context in the chain holds that key, the result is nil — not an error, not a zero string, not a panic. That means every read has two failure modes a handler must survive: the key was never attached, and the key was attached with a different concrete type than you expect. The comma-ok form of the type assertion covers both: ```go id, ok := r.Context().Value(tenantKey{}).(string) ``` When the assertion fails, `id` is the zero value (`""`) and `ok` is false. When you use the single-result form instead, a mismatch panics at runtime with `interface conversion: interface {} is nil, not string`. ## Why the bare assertion is a trap The bare assertion looks fine in every test where the middleware is in the chain, which is every test you wrote. It fails the day someone registers a route on a mux that does not go through that middleware, or reorders the chain, or adds a health endpoint that skips it. Then a request that should have produced a clean "this route is misconfigured" error instead panics inside a handler. `net/http` recovers a handler panic per connection so the process survives, but the client gets an abrupt failure and the stack trace lands in the server's error log rather than anywhere you look first. The comma-ok form turns that into a decision you control. ## Handle the missing case deliberately The interesting judgment is what to do when `ok` is false. Three options, and only one of them is right for a tenant id: - **Return 500.** A missing request-scoped value is a server-side wiring defect, not something the caller did wrong. 500 is honest, it is loud in your error rate, and it does not teach the client to retry with different input. - **Return 400.** Wrong: the client's request may have been perfectly well formed; the middleware that would have resolved the tenant never ran. - **Fall back to a default.** Actively dangerous in a multi-tenant service. An empty tenant id flows into a query, and depending on how the data layer treats an empty scope you either return nothing or return rows belonging to somebody else. The cross-tenant data mix-up an engineer eventually has to debug starts as a defaulted empty string in one handler. ## Give the read a typed front door The pattern that keeps this small is to put the key and the accessor in the package that attaches the value, and export only the accessor: ```go type tenantKey struct{} func TenantFrom(ctx context.Context) (string, bool) { id, ok := ctx.Value(tenantKey{}).(string) return id, ok } ``` Handlers then call `TenantFrom(r.Context())` and get a `(string, bool)` pair. The concrete type of the stored value is decided in exactly one place, so a change from a `string` to a `*Tenant` struct is a compiler-checked refactor instead of a runtime surprise scattered across handlers. It also makes the read cheap to mock in tests: a test builds a context with the same package's attach function and calls the handler directly. ## Take a copy, not a reference to the request A request-scoped value is exactly that: scoped to the request. Read it out and use it inside the handler; do not stash the value, the context or the `*http.Request` in a package-level map, a struct field on a shared handler, or a long-lived cache so some other code can "look it up later". Those places are shared by every concurrent request, and the next request overwrites what the last one put there. If you need the id in a helper, pass it as an ordinary parameter or pass the context — that is what the parameter list is for. ## Small details worth stating - `r.Context()` is documented to be non-nil always, so you never need a nil check on the context itself; the nil you must handle is the `Value` result. - The lookup is a linear walk up the chain, so it is a lookup, not a map hit; reading the same value in a tight loop is worth hoisting into a local variable. - Reading is cheap but not free of ceremony — that is the point of the accessor: one place to get the key, the type and the missing-value contract right.