I am working on a web project that let a person send a request form to my API. Every visitor can send a request through that form without login.

Currently the API generates a token when the page is first opened, and the token is then sent back with the POST request form. But that one token can be used to send another POST request. Even worse if an attacker knows the token, they can send a POST request with some script without visiting the website anymore.

Currently I invalidate the token after some period of time. But in that mean time, the attacker can send multiple request with an ajax script. I intend to invalidate the token after each POST request, but that doesn't prevent the attacker to send multiple POST request because they can also request a new token before each POST request.

Is there any way to stop an attacker from sending multiple request from a malicious script, without using the form on my website?

  • 1
    Exactly what is it that you want to prevent here? That an attacker "tricks" some user into sending requests to your server? Or that the attacker herself sends multiple requests to your server without actually "visiting" your website?
    – Anders
    Commented Apr 20, 2018 at 7:35
  • @Anders, this one "that the attacker herself sends multiple requests to your server without actually 'visiting' your website?". Commented Apr 20, 2018 at 10:01
  • I tried to edit the question to reflect that; if you think I got the quesiton wrong, please edit to correct that.
    – Anders
    Commented Apr 20, 2018 at 10:54
  • Yes, that's right. Thanks for clarify the question. Commented Apr 20, 2018 at 11:07

1 Answer 1


First of all, this is not request forgery, since there is no logged in session to take advantage of. It makes little sense to trick a user into submitting a form on your behalf.

That said, a standard CSRF cookie would do the job. Generate a unique value for the cookie you already use, on each request. Then check that it is only used once.

  • Completely agree on the first paragraph! The OP clarified the question, and it seems that the second paragraph might not be inline with what OP meant.
    – Anders
    Commented Apr 20, 2018 at 10:56
  • 2
    True, this sounds more like a case for simple throttling... Commented Apr 20, 2018 at 11:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .