Update Apache SSL configuration and enhance security features across multiple files. Changed X-Frame-Options to SAMEORIGIN for better security, added optional Content Security Policy headers for testing, and improved password handling with HaveIBeenPwned checks during user registration and password reset. Implemented passkey login functionality in the authentication flow, including UI updates for user experience. Enhanced image upload processing with size limits and validation, and added rate limiting for various API endpoints to prevent abuse.

apache-ssl-config.conf

@@ -21,11 +21,14 @@
 
     # Security Headers
     Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
-    Header always set X-Frame-Options DENY
+    Header always set X-Frame-Options SAMEORIGIN
     # X-Content-Type-Options wird vom Nuxt-Server gesetzt
     Header always set Referrer-Policy "strict-origin-when-cross-origin"
     Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
 
+    # Optional: Content Security Policy (zuerst Report-Only testen)
+    # Header always set Content-Security-Policy-Report-Only "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; font-src 'self' https://fonts.gstatic.com data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; script-src 'self'; img-src 'self' data: blob:; connect-src 'self'"
+
     # Proxy alle Anfragen an Nuxt Server (Port 3100)
     ProxyPreserveHost On
     ProxyPass / http://localhost:3100/