Tag Info

New answers tagged


You could block the user IP address after few attempts within certain period of time (say if certain IP address sends 10 requests over 1 minutes, then block the IP for 10 minutes.


I'm not sure if this is the best idea, but it's a decent start to prevent brute forcing your validator. Include a random hash with the original form that has to be passed to the endpoint. Keep a counter in non-persistent storage referencing that hash which expires after some reasonably short timeframe. Then start returning 503 errors after some threshold ...

Top 50 recent answers are included