New answers tagged ajax
You could block the user IP address after few attempts within certain period of time (say if certain IP address sends 10 requests over 1 minutes, then block the IP for 10 minutes.
I'm not sure if this is the best idea, but it's a decent start to prevent brute forcing your validator. Include a random hash with the original form that has to be passed to the endpoint. Keep a counter in non-persistent storage referencing that hash which expires after some reasonably short timeframe. Then start returning 503 errors after some threshold ...
Top 50 recent answers are included