feat: add rate limiting, case-insensitive usernames and session security

2026-02-21 14:03:34 +01:00
parent 638a27208f
commit 22a6bc5123
5 changed files with 26 additions and 8 deletions
--- a/app/Http/Controllers/Auth/RegisterController.php
+++ b/app/Http/Controllers/Auth/RegisterController.php
@@ -37,7 +37,15 @@ class RegisterController extends Controller
        }

        $request->validate([
-            'username' => ['required', 'string', 'max:255', 'alpha_dash', 'unique:'.User::class],
+            'username' => [
+                'required', 'string', 'max:255', 'alpha_dash',
+                function ($attribute, $value, $fail) {
+                    $exists = User::whereRaw('LOWER(username) = ?', [strtolower($value)])->exists();
+                    if ($exists) {
+                        $fail('The username has already been taken.');
+                    }
+                },
+            ],
            'first_name' => ['required', 'string', 'max:255'],
            'last_name' => ['required', 'string', 'max:255'],
            'email' => ['required', 'string', 'lowercase', 'email', 'max:255', 'unique:'.User::class],