Concurrent sessions limited to 1, warning on new login

Unlimited concurrent sessions mean a stolen session token can be used in parallel with the legitimate user's session — the account owner has no indication the account is being accessed simultaneously from a different location. CWE-613 covers this under insufficient session expiration. PCI-DSS Req 8.2.8 and NIST AC-10 both address concurrent session controls. In financial applications, the attack pattern is: steal session token, establish parallel session, initiate transfer while the legitimate user is actively transacting and won't notice a concurrent login warning. Limiting concurrent sessions to one and notifying on new logins closes this window — the attacker's session either terminates or the user receives a warning.

Enforce the single-session limit in src/middleware/concurrentSessionCheck.ts by checking active session count on each new login and either terminating prior sessions or alerting the user:

export async function enforceSessionLimit(
  userId: string,
  currentSessionId: string
) {
  const active = await db.sessions.findMany({
    where: { userId, expiresAt: { gt: new Date() } }
  });

  if (active.length > 0) {
    await notifyUser(userId, 'New login detected — prior session terminated.');
    await db.sessions.updateMany({
      where: { userId, id: { not: currentSessionId } },
      data: { terminatedAt: new Date() }
    });
  }
}

Call enforceSessionLimit immediately after session creation in the login handler, before returning the session token to the client. Store sessions server-side (Redis or Postgres) so termination is authoritative — client-side token deletion alone is insufficient.