v1.0.4: Security hardening - rate limiting, middleware, HSTS, password strength, anti-enumeration

src/app/api/auth/delete-account/route.ts

@@ -3,10 +3,15 @@ import { prisma } from '@/lib/db'
 import { getSession } from '@/lib/auth'
 import bcrypt from 'bcryptjs'
 import { cookies } from 'next/headers'
+import { deleteAccountLimiter, getClientIp, rateLimitResponse } from '@/lib/rate-limit'
 
 // POST: User deletes their own account
 export async function POST(req: NextRequest) {
   try {
+    const ip = getClientIp(req)
+    const rl = deleteAccountLimiter.check(ip)
+    if (!rl.success) return rateLimitResponse(rl.resetAt)
+
     const session = await getSession()
     if (!session) return NextResponse.json({ error: 'Nicht autorisiert' }, { status: 401 })