feat: Security CSRF Fix, Logout optimierung, Footer Anpassung, Rechtstexteanpassung

src/app/api/business-inquiry/route.ts

@@ -3,8 +3,14 @@ import { prisma } from "@/lib/prisma";
 import { businessInquirySchema } from "@/lib/validation";
 import { rateLimit, getClientIp } from "@/lib/rate-limit";
 import { verifyTurnstileToken } from "@/lib/turnstile";
+import { isTrustedOrigin } from "@/lib/csrf";
 
 export async function POST(request: Request) {
+  // Route-Handler haben keinen eingebauten CSRF-Schutz — siehe lib/csrf.ts.
+  if (!isTrustedOrigin(request)) {
+    return NextResponse.json({ error: "Ungültige Anfrage." }, { status: 403 });
+  }
+
   const ip = await getClientIp();
   if (!rateLimit(`business-inquiry:${ip}`, 5, 60 * 60 * 1000)) {
     return NextResponse.json(

src/app/api/checkout/route.ts

@@ -6,6 +6,7 @@ import { checkoutSchema } from "@/lib/validation";
 import { getProductsByIds } from "@/lib/data";
 import { getCurrentCustomer } from "@/lib/auth";
 import { rateLimit, getClientIp } from "@/lib/rate-limit";
+import { isTrustedOrigin } from "@/lib/csrf";
 import { getShippingCostCents } from "@/lib/shipping";
 import { isDiscountCodeValid, calculateDiscountCents } from "@/lib/discount-calc";
 import { ensureBulkDiscountCode } from "@/lib/bulk-discount";
@@ -23,6 +24,14 @@ function generateOrderNumber(): string {
 }
 
 export async function POST(request: Request) {
+  // Route-Handler haben (anders als Server Actions) keinen eingebauten
+  // CSRF-Schutz — siehe lib/csrf.ts. Ohne diese Pruefung koennte eine fremde
+  // Seite per gefaelschtem Cross-Site-POST Bestellungen unter dem Konto
+  // einer eingeloggten Kundschaft anlegen und Lagerbestand reservieren.
+  if (!isTrustedOrigin(request)) {
+    return NextResponse.json({ error: "Ungültige Anfrage." }, { status: 403 });
+  }
+
   const ip = await getClientIp();
   if (!rateLimit(`checkout:${ip}`, 10, 60 * 60 * 1000)) {
     return NextResponse.json(

src/app/api/newsletter/route.ts

@@ -7,9 +7,15 @@ import { sendMail } from "@/lib/mail";
 import { newsletterConfirmEmail } from "@/lib/email-templates";
 import { getBaseUrl } from "@/lib/url";
 import { verifyTurnstileToken } from "@/lib/turnstile";
+import { isTrustedOrigin } from "@/lib/csrf";
 import { getLocale } from "@/i18n/locale";
 
 export async function POST(request: Request) {
+  // Route-Handler haben keinen eingebauten CSRF-Schutz — siehe lib/csrf.ts.
+  if (!isTrustedOrigin(request)) {
+    return NextResponse.json({ error: "Ungültige Anfrage." }, { status: 403 });
+  }
+
   const ip = await getClientIp();
   if (!rateLimit(`newsletter:${ip}`, 5, 60 * 60 * 1000)) {
     return NextResponse.json(