We have Ajax call to validate the UserID on create page so that user there only can know if their chosen ID is available or not.
We have this URL exposed :
https://mydomain.com/validateId?id=<user enter value>
Lately some hackers are sending large amount of concurrent requests to this URL and we are observing very high load on CPU's even to 100%
We don’t have any session identifiers available in the action for that Ajax calls. What technique can we use to prevent so many direct concurrent calls? Any way to identify if the users are firing these Ajax calls from the create pages and not directly using some malicious tools?