im getting more and more spam account registrations. what is the simplest way to handle this if one does not need browser based registration? people register the REST/services way via an app.
can this be achieved without additional modules? e.g. server redirect?
If you don't need user self-registration then just disable that functionality.
To do this go to :
/admin/config/people/accounts (Admin > Configuration > People > Account Settings)
And for the Who can register accounts? setting choose Administrators only.
If later on you decide that you need that functionality, you can enable it back and then just add a captcha to your user registration form, or integrate something like honeypot or logintoboggan.
