Aktueller Stand

lib/auth.ts

@@ -3,6 +3,7 @@ import bcrypt from "bcryptjs";
 import type { NextAuthOptions } from "next-auth";
 import CredentialsProvider from "next-auth/providers/credentials";
 import { prisma } from "./prisma";
+import { checkRateLimit, getRateLimitConfig } from "./rate-limit";
 
 const MAX_LOGIN_ATTEMPTS = 5;
 const LOGIN_WINDOW_MINUTES = 15;
@@ -76,6 +77,15 @@ export const authOptions: NextAuthOptions = {
 
         const email = normalizeEmail(credentials.email);
         const ip = getClientIp(req);
+        const rateConfig = getRateLimitConfig("RATE_LIMIT_LOGIN", 10);
+        const rate = await checkRateLimit({
+          key: `login:${email}:${ip}`,
+          limit: rateConfig.limit,
+          windowMs: rateConfig.windowMs
+        });
+        if (!rate.ok) {
+          throw new Error("RATE_LIMIT");
+        }
         let attempt: { id: string; attempts: number; lastAttempt: Date; lockedUntil: Date | null } | null = null;
         try {
           attempt = await prisma.loginAttempt.findUnique({