I'm using Drupal Services along with Drupal Commerce Services to make an e-commerce site that runs on JS/Backbone.
I want to prevent a user from being able to flood an API endpoint with requests, because in my initial tests it seems that hitting a few endpoints every 100ms kills my Mariadb process after about half a minute. Although I think it's actually the massive increase in PHP-FPM that does it. Either way, I'm looking for a Drupal-first route, so it will be solid on the server, client and api.
I'm not looking for anything regarding hiding the submit button or anything like that, I'd rather something that would "lock" any JSON requests if, say, 5 requests are made in 10 seconds, based on IP, sessionID and others. Similar to what fail2ban or the NPM flood module does.
It may be a basic module tat I've just not found yet, so apologies if the answer should be obvious.