We leverage a lot of Apex remote calls in our Salesforce experience site. We have a public signup page where we allow registration to our site. This is an apex remote method which creates a record in a custom object. Someone enters their info (name, email, etc) and clicks "Submit". The "Submit" button is hidden behind Google reCAPTCHA. This registration page is exposed to public guest user.
Problem is Apex remote calls can be exploited. Someone can perform a signup, record the apex remote call in Chrome network console, and re-submit the call over and over again without needing the UI "Submit" button. This will allow them to spam our registration functionality without needing to go through reCAPTCHA.
Is there a way I can lock an apex remote method called from a guest user behind reCAPTCHA? problem is without an authenticated user, i cant update any flag on the user to say they have completed reCAPTCHA. I can't pass a parameter to the Apex remote either, because that would be exploited via the spamming.
Anyone have any ideas? Thanks!