This is a general question but its prompted by a fairly open API I have for a file storage service that needs to have its front door better locked down.
We have an API like
POST '/signup' that just takes a username and password and creates a user. It is totally possible for someone to write a very simple script to call
/signup with every letter combination that fits our username rules and effectively brick us from new signups.
I have not found a concise enumeration of all the possible signup security tricks, so I will start them now and ask for anyone to contribute what I have omitted or further implementation details on a particular item.
IP Throttling: For every signup, record the IP address and check it against a table of recent signup IPs to ensure number of signups and time since last signup at this IP is not suspicious. **
Other authorized login: Use verified email, phone number, or 3rd party OAuth logins
Human verification: Have the users complete a Captcha or some form of validation that is too computationally expensive for a script to manage
** IP throttling seems to be the only option that will not necessarily affect the client signup experience, although at the cost of implementing a new subsystem to orchestrate the storage and validation of IPs (Are there 3rd party services for this?). It also does not protect against the extreme case where a network of attackers (or attackers that can change public IP) distribute the attack across N IPs to make N usernames.