Temporary hold on time slot

In multi-step booking flows, the gap between slot selection and payment completion can span several minutes of form-filling. Without a temporary hold during that window, a second user can select the same slot, complete the flow first, and the original user hits a conflict error at the payment step — after they've already entered card details. CWE-362 describes this as a classic TOCTOU (time-of-check to time-of-use) window. The user experience failure is severe: you've collected full intent and payment details from a customer only to tell them at the last step that the slot is gone.

Implement a Redis key with a TTL or a database row with status='HELD' and an expiresAt timestamp when the user selects a slot. Add this in your slot-selection handler (e.g., src/app/api/bookings/hold/route.ts).

// Redis-based hold — 5-minute TTL, no-overwrite (NX)
await redis.set(`booking:hold:${slotId}:${userId}`, '1', 'NX', 'EX', 300);

// Or: database hold record
await db.bookingHold.create({
  data: { slotId, userId, expiresAt: addMinutes(new Date(), 5) }
});

Also add a cleanup job or TTL-expiry mechanism so abandoned holds don't block slots indefinitely.