diff --git a/lib/Controller/SlaveController.php b/lib/Controller/SlaveController.php
index fa42dce5..fe1f98a2 100644
--- a/lib/Controller/SlaveController.php
+++ b/lib/Controller/SlaveController.php
@@ -104,10 +104,7 @@ public function __construct(
 	 * @PublicPage
 	 * @NoCSRFRequired
 	 * @UseSession
-	 *
-	 * @param string $jwt
-	 *
-	 * @return RedirectResponse
+	 * @BruteForceProtection(action=autoLogin)
 	 */
 	public function autoLogin(string $jwt): RedirectResponse {
 		$this->logger->debug('autologin incoming request with ' . $jwt);
@@ -119,11 +116,10 @@ public function autoLogin(string $jwt): RedirectResponse {
 			return new RedirectResponse('');
 		}
 
-		if ($this->gss->isMaster()) {
-			return new RedirectResponse($masterUrl);
-		}
-		if ($jwt === '') {
-			return new RedirectResponse($masterUrl);
+		if ($this->gss->isMaster() || $jwt === '') {
+			$response = new RedirectResponse($masterUrl);
+			$response->throttle();
+			return $response;
 		}
 
 		try {
@@ -162,12 +158,14 @@ public function autoLogin(string $jwt): RedirectResponse {
 			}
 		} catch (ExpiredException $e) {
 			$this->logger->info('token expired');
-
-			return new RedirectResponse($masterUrl);
+			$response = new RedirectResponse($masterUrl);
+			$response->throttle();
+			return $response;
 		} catch (\Exception $e) {
 			$this->logger->warning('issue during login process', ['exception' => $e]);
-
-			return new RedirectResponse($masterUrl);
+			$response = new RedirectResponse($masterUrl);
+			$response->throttle();
+			return $response;
 		}
 
 		$this->logger->debug('all good. creating session');
@@ -186,16 +184,15 @@ public function autoLogin(string $jwt): RedirectResponse {
 	}
 
 	/**
-	 * Create app token
-	 *
 	 * @PublicPage
 	 * @NoAdminRequired
-	 *
-	 * @return DataResponse
+	 * @BruteForceProtection(action=createAppToken)
 	 */
-	public function createAppToken($jwt) {
+	public function createAppToken($jwt): DataResponse {
 		if ($this->gss->getMode() === 'master' || empty($jwt)) {
-			return new DataResponse([], Http::STATUS_BAD_REQUEST);
+			$response = new DataResponse([], Http::STATUS_BAD_REQUEST);
+			$response->throttle();
+			return $response;
 		}
 
 		try {
@@ -225,7 +222,9 @@ public function createAppToken($jwt) {
 			$this->logger->info('issue while token creation', ['exception' => $e]);
 		}
 
-		return new DataResponse([], Http::STATUS_BAD_REQUEST);
+		$response = new DataResponse([], Http::STATUS_BAD_REQUEST);
+		$response->throttle();
+		return $response;
 	}
 
 	/**