عرض عملي: التسجيل مع تجزئة كلمات المرور والتقييد

خطوة بخطوة

1. Add the encoder bean and a POST /api/auth/register endpoint with validation (length, email format).
2. Hash the password in the service; store only the hash.
3. Return the same response whether or not the email already exists (or a generic message).
4. Add a simple in-memory throttle: 5 failures per account and IP, then 429 for a period.
5. Planned mistake: logging the whole request body, which prints the password. Fix: log only the email and mask or skip bodies.
6. Search logs and database for any plaintext password.