We have Ajax call to validate the useridUserID on create page so that user there only can know if their choosenchosen ID is available or not.
We have this URL exposed : https://mydomain.com/validateId?id=
https://mydomain.com/validateId?id=<user enter value>
Lately some hackers are sending large amount of concurrent requests to this URL and we are observing very high load on CPU's even to 100%
We dontdon’t have any session identifiers available in the action for that Ajax calls. What technique can we use to prevent so many direct concurrent calls ? Any way to identify if the users are firing these Ajax calls from the Createcreate pages and not directly using some malicious tools ?