Stack
Next.jsGoGinPostgreSQLRedisDocker
Overview
A learning management system spanning course creation, enrollment, exam authoring, and instructor and student dashboards, built on a Go backend with hand-rolled session authentication and an asynchronous file-processing pipeline for uploads. Architected specifically to perform correctly under concurrent exam-submission load rather than conventional CRUD traffic, with connection pooling and isolation levels tuned from measured load-test results.
Challenge
Under bursts of simultaneous exam submissions, connections began resetting in a pattern that initially resembled an application-level concurrency bug. The root cause was one layer below the application: the OS-level TCP listen backlog saturating, compounded by the load-test client sharing a single HTTP transport across simulated users. Resolving it required isolating each simulated client's transport and warming connections ahead of the burst, then re-tuning the Postgres connection pool size and isolation level from measured load-test results rather than default assumptions.
Outcome
Load-tested to 650 concurrent exam submissions with zero lost writes. A written threat model for the authentication layer led to identifying and fixing a timing-attack vulnerability that could reveal whether a given username existed, verified closed through post-fix re-measurement.
