Online Student Portal System
A comprehensive web-based academic administration system built for university environments, consolidating administrative operations, identity management, academic record handling, and departmental workflows into a unified, institution-controlled platform.
System Overview
The Online Student Portal System (OSPS) is a production-delivered academic administration suite designed for higher-education environments. Developed on the MERN stack (MongoDB, Express.js, React, Node.js), the platform organizes institutional operations through a Model-View-Controller (MVC) pattern combined with a modular controller-service separation for maintainable and scalable code organization.
The system centralizes student lifecycle handling, departmental administration, course registration, and faculty assessment workflows while enforcing strict institutional governance and data consistency standards.
Hierarchical Role-Based Access Control (RBAC)
The portal defines four principal user tiers with clear hierarchical privilege boundaries:
- Master Administrator: A setup-time bootstrap identity with immutable core attributes, responsible for provisioning and overseeing institutional department administrators.
- Department Administrator: Exercises administrative control over academic operations within assigned faculties, including managing faculty profiles, student admissions, and departmental course catalogs.
- Faculty: Manages instructional duties, active course section configurations, student attendance registers, and academic assessment submissions.
- Student: Accesses academic transcripts, enrollment statuses, and coursework progress with strictly governed profile editing boundaries.
Security & Session Management Algorithms
The security implementation is engineered to mitigate credential leaks, session hijacking, and unauthorized token inspection:
-
Server-Managed Cookie Authentication: Authentication tokens are stored strictly within server-issued
HTTP-only,SameSitecookies, preventing JavaScript-based credential extraction and XSS surface exposure. - JWT Refresh-Token Rotation: Short-lived access tokens paired with rotating refresh tokens ensure compromised tokens expire automatically without disrupting active sessions.
- FIFO Concurrent-Session Eviction: Users are restricted to a maximum of three active concurrent sessions. When a fourth login occurs, the backend executes a First-In-First-Out (FIFO) eviction algorithm, revoking the oldest active session token in MongoDB.
- Rate-Limited OTP Password Recovery: Email-based One-Time Password recovery is protected by a dual throttle: a maximum of 3 OTPs per user per day and a mandatory 2-minute cooldown between successive requests to prevent exhaustion attacks.
Controlled Student Profile Window
To prevent arbitrary tampering with student identification records while accommodating onboarding needs, the portal introduces a time-limited update window algorithm:
Newly admitted students receive a strict three-day window from account creation to update their profile photo and initial password. Once this 72-hour window elapses, profile modification privileges are automatically locked. Subsequent changes mandate verified administrative intervention through the Department Administrator, ensuring institutional integrity over student records.
Referential-Integrity Enforcement on Deletions
Unlike permissive administrative backends that risk orphan records, this platform enforces explicit referential-integrity checking on hard delete operations:
Prior to deleting any foundational entity—such as departments, academic programs, courses, or academic terms—the service layer validates that no child dependencies or active references exist in connected collections. If references remain, deletion is rejected with structured relational error feedback, safeguarding institutional data trees.