How to prevent people from keep looping HTTP POST to a function?

Question

I am trying to develop a website, the website got a pop-up modal which allows the user to subscribe to our latest promotion. In that input, we got a textbox to allow users to key in their email.

However, when we look at the HTML code, the HTTP POST URL is visible:

If someone is trying to use this URL, and spam HTTP POST requests (see below), unlimited entries can be created in the subscriber database table.

for (int a = 0; a < 999999; a++)
{
    var values = new Dictionary<string, string>
    {
        { "email", a+"@gmail.com" }
    };

    var content = new FormUrlEncodedContent(values);
    var response = await client.PostAsync("http://www.example.com/recepticle.aspx", content);
    var responseString = await response.Content.ReadAsStringAsync();
}

How can I prevent this from happening? We cannot put a capcha, since this is subscriber to our promotion.

Edit: Please note that a ANTI-forgery token will not work, because the hacker can download entire HTML string using GET, and get the value from the anti forgery token textbox and POST the value to the POST URL again, so it will not work and the same anti-forgery token can use multiple times, it is not secure.

Answer 1

You can choose one of the below option to implement what you are looking for.

1- Implement CAPTCHA/re-CAPTCHA, it will make sure that using any tool request can't be made. I understand that you don't want to use CAPTCHA, I still feel you should go with it, as it is the best approach to handle this type of scenarios.

2- IP Based restriction, lock submitting the request from one IP for some time.

3- Other option can be OTP (one time password), you can send the OTP to the email, and only after successful verification you can register the email.

Answer 2

Use AntiForgeryToken. Read more about Antiforgery Tokens here

1. In your form Razor View, Add an @Html.AntiForgeryToken() as a form field.

   @using (Html.BeginForm())
   {
       @Html.AntiForgeryToken()
   
       <div class="form-horizontal">
           @*Rest of the form*@
   }
   

2. In your Action Method use ValidateAntiForgeryTokenAttribute

   [HttpPost]
   [ValidateAntiForgeryToken]
   public ActionResult Edit( MyViewModel form)
   {
       if (ModelState.IsValid)
       {
          // Rest of ur code
       }
    }