I am implementing quick checkout in my e-store.
Customer only have to enter email and phone number to make an order, system checks whether customer with such fields already registered, if not it automatically registers as new customer and completes the order.
So, there is no session, no cookies or tokens. The problem is obvious, someone can just send thousands of requests to make an order and this not only will make server unavailable but create a lot of data in DB.
What is the best way to protect from such attacks ? Using something like nonce or CSRF token won't save from attacks because they are not tied to the session, the is no session.
Please suggest the best way to protect from attacks in my case.