Token system can be used to avoid spamming. Using token , the server side code will be able to authorize the request before processing.
1. Create the token[long alphanumeric number] on page load on server side and send it to client where it will be a hidden input.
2. Create a session-variable and store the token value in it.
3. Client when requesting again will send the hidden input token with HTTP request.
4. On server side the session-variable token and the token from client side will be match.
5. If matched then process the request and create a new token again and also store it to session-variable.
6. if not matched the throw error message.
Try the application. Below is the Demo link and the source code.