I am developing a website that has user registration. I already built some rate-limit protection techniques using nginx and at a lower level using iptables, but I am worried about real-world attacks like ip-spoofing or DDoS.
The only solution I know is Google's CAPTCHA which is even used by big companies like Reddit and Gitlab. The problem is that it's not friendly on mobile and tablet devices, and in addition it puts visitors off.
Is there any known clean and cheap method for HTTP POST request floods? I thought to add a temporary random token to POST parameters that is stored also on my server for one or two seconds using Redis to check whether the request is automated (i.e. fast) or by a human (slow). I don't want to convince myself this is a reliable solution since I am no security expert.