How can I restrict users from spamming my web service by sending thousands of requests?
My web service is actually protected by a validation token only accessible through authentication, but I still can't avoid the fact that my web service will check if the token exists in my database.
I thought about saving the number of attempts by IP, but still, I would have to check every time in my database if the trying IP is blacklisted.
Is there any way to avoid web services spammers?