How can I securely check if a username is already taken?

Question

I have a form where someone can create a new user. I'd like to add some AJAX to check if a username is taken, as soon as the input field loses focus. I'm not really sure how to go about this, as this could pave the way to bruteforce attack, since you could check for any username and see whether or not it exists. Any suggestions?

Answer 1

Probably the best option is to limit, in the server-side script, the number of attempts a user is allowed to make (based on either session, or IP) to a sensible limit (ie. 10) within a 30 minute time period.

Another option would be to put a captcha on the page to ensure that the user is a human and not a bruteforcing program.