Update Apache SSL configuration and enhance security features across multiple files. Changed X-Frame-Options to SAMEORIGIN for better security, added optional Content Security Policy headers for testing, and improved password handling with HaveIBeenPwned checks during user registration and password reset. Implemented passkey login functionality in the authentication flow, including UI updates for user experience. Enhanced image upload processing with size limits and validation, and added rate limiting for various API endpoints to prevent abuse.

server/api/newsletter/unsubscribe-by-email.post.js

@@ -1,6 +1,7 @@
 import { readSubscribers, writeSubscribers } from '../../utils/newsletter.js'
 import fs from 'fs/promises'
 import path from 'path'
+import { assertRateLimit, getClientIp, registerRateLimitFailure, registerRateLimitSuccess } from '../../utils/rate-limit.js'
 
 // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
 // filename is always a hardcoded constant (e.g., 'newsletter-subscribers.json'), never user input
@@ -40,6 +41,23 @@ export default defineEventHandler(async (event) => {
       })
     }
 
+    const ip = getClientIp(event)
+    const emailKey = String(email || '').trim().toLowerCase()
+    assertRateLimit(event, {
+      name: 'newsletter:unsubscribe:ip',
+      keyParts: [ip],
+      windowMs: 10 * 60 * 1000,
+      maxAttempts: 30,
+      lockoutMs: 15 * 60 * 1000
+    })
+    assertRateLimit(event, {
+      name: 'newsletter:unsubscribe:email',
+      keyParts: [emailKey],
+      windowMs: 10 * 60 * 1000,
+      maxAttempts: 8,
+      lockoutMs: 30 * 60 * 1000
+    })
+
     if (!groupId) {
       throw createError({
         statusCode: 400,
@@ -75,6 +93,8 @@ export default defineEventHandler(async (event) => {
 
     if (!subscriber) {
       // Nicht gefunden - aber trotzdem Erfolg zurückgeben (keine Information preisgeben)
+      await registerRateLimitFailure(event, { name: 'newsletter:unsubscribe:ip', keyParts: [ip] })
+      await registerRateLimitFailure(event, { name: 'newsletter:unsubscribe:email', keyParts: [emailKey] })
       return {
         success: true,
         message: 'Sie wurden erfolgreich vom Newsletter abgemeldet'
@@ -89,6 +109,8 @@ export default defineEventHandler(async (event) => {
     // Prüfe ob für diese Gruppe angemeldet
     if (!subscriber.groupIds.includes(groupId)) {
       // Nicht für diese Gruppe angemeldet - aber trotzdem Erfolg zurückgeben
+      await registerRateLimitFailure(event, { name: 'newsletter:unsubscribe:ip', keyParts: [ip] })
+      await registerRateLimitFailure(event, { name: 'newsletter:unsubscribe:email', keyParts: [emailKey] })
       return {
         success: true,
         message: 'Sie wurden erfolgreich vom Newsletter abgemeldet'
@@ -107,6 +129,7 @@ export default defineEventHandler(async (event) => {
 
     await writeSubscribers(subscribers)
 
+    registerRateLimitSuccess(event, { name: 'newsletter:unsubscribe:email', keyParts: [emailKey] })
     return {
       success: true,
       message: 'Sie wurden erfolgreich vom Newsletter abgemeldet'