🟡 Security: Server-Side Exam Timer Validation

[Goodnessukaigwe]

Priority: 🟡 MEDIUM

Description:
The exam timer is client-side only, which means students can manipulate the timer by pausing JavaScript, editing browser storage, or using dev tools.

Security Risk:
Students could extend exam time by:

• Pausing browser execution
• Editing localStorage
• Using browser dev tools
• Refreshing the page

Proposed Solution:

1. Create exam_sessions table
2. Record start time on server when student begins exam
3. Validate submission time server-side
4. Reject submissions after deadline

API Changes Needed:

• POST /api/exams/start - Record exam start time
• POST /api/exams/submit - Validate time before accepting

Action Items:

• Create exam_sessions table in database
• Add /api/exams/start endpoint
• Update exam page to record start time
• Add server-side time validation in submit endpoint
• Handle edge cases (network issues, browser crashes)
• Add grace period (e.g., 30 seconds) for submission

See GITHUB_ISSUES.md for database schema and implementation details.