Aktueller Stand

app/api/register/route.ts

@@ -4,6 +4,8 @@ import { randomUUID } from "crypto";
 import { prisma } from "../../../lib/prisma";
 import { isAdminEmail, isSuperAdminEmail } from "../../../lib/auth";
 import { sendMail } from "../../../lib/mailer";
+import { checkRateLimit, getRateLimitConfig } from "../../../lib/rate-limit";
+import { getClientIp } from "../../../lib/request";
 
 export async function POST(request: Request) {
   const registrationSetting = await prisma.setting.findUnique({
@@ -24,6 +26,21 @@ export async function POST(request: Request) {
     return NextResponse.json({ error: "Email und Passwort sind erforderlich." }, { status: 400 });
   }
 
+  const ip = getClientIp(request);
+  const rateKey = `register:${normalizedEmail}:${ip}`;
+  const rateConfig = getRateLimitConfig("RATE_LIMIT_REGISTER", 5);
+  const rate = await checkRateLimit({
+    key: rateKey,
+    limit: rateConfig.limit,
+    windowMs: rateConfig.windowMs
+  });
+  if (!rate.ok) {
+    return NextResponse.json(
+      { error: "Zu viele Anfragen. Bitte später erneut versuchen." },
+      { status: 429 }
+    );
+  }
+
   const existing = await prisma.user.findUnique({ where: { email: normalizedEmail } });
   if (existing) {
     return NextResponse.json({ error: "Account existiert bereits." }, { status: 409 });