I am working on a web project that let a person send a request form to my API. Every visitor can send a request through that form without login.
Currently the API generates a token when the page is first opened, and the token is then sent back with the POST request form. But that one token can be used to send another POST request. Even worse if an attacker knows the token, they can send a POST request with some script without visiting the website anymore.
Currently I invalidate the token after some period of time. But in that mean time, the attacker can send multiple request with an ajax script. I intend to invalidate the token after each POST request, but that doesn't prevent the attacker to send multiple POST request because they can also request a new token before each POST request.
Is there any way to stop an attacker from sending multiple request from a malicious script, without using the form on my website?