[Bug]: TOCTOU race allows bypassing MAX_SESSIONS limit under concurrent session creation

[hariom888]

Bug Description

createSession (backend/controllers/sessionController.js) checks the session count via Session.countDocuments({ user: userId }) against MAX_SESSIONS, then creates a new Session afterward. There is no atomicity between the count check and the create, so concurrent requests can each read the same pre-creation count and independently pass the check.

Steps to Reproduce

1. Authenticate as a user sitting at MAX_SESSIONS - 1 sessions.
2. Fire several concurrent POST requests to /api/sessions/create (e.g. via Promise.all).
3. Check the user's total session count via GET /api/sessions/my-sessions afterward.

Expected Behavior

At most one of the concurrent requests should succeed once the user reaches MAX_SESSIONS; all others should be rejected with the session-limit error.

Actual Behavior

Multiple concurrent requests all pass the countDocuments check and all successfully create sessions, allowing the user's total session count to exceed MAX_SESSIONS.

Severity

Low

Screenshots / Screen Recording

No response

Browser

No response

Operating System

No response

Additional Context

No response

[hariom888]

Technical understanding: This is a check-then-act race condition — countDocuments and Session.create are two separate round trips with no locking or atomic guard between them, so the enforcement only works for strictly sequential requests.

Affected: backend/controllers/sessionController.js (createSession).

Proposed fix approach: enforce the cap at the data layer instead of via a pre-check — e.g. wrap the count-check-create in a MongoDB transaction (session.startTransaction) so the count and insert are serialized, or perform the count check again immediately before the final session.save() and roll back (delete) the just-created session/questions if the recount exceeds the limit. A simpler mitigation is a per-user mutex/lock (e.g. via a short-lived Mongo document lock) around the whole operation.

Regression tests: simulate N parallel createSession calls when the user is at MAX_SESSIONS - 1 and assert exactly one succeeds; verify sequential behavior is unaffected.

Requesting assignment under GSSoC'26.