I'm working on a website which necessitates the use of server generated codes, which are displayed once to the user and then stored in a database.

I plan on using /dev/urandom as a source of entropy to ensure that the pseudorandom codes are cryptographically secure, as it is crucial that future codes are not predictable.

But I am concerned that someone could repeatedly generate codes, drain the entropy pool, and thus be able to predict future codes. Will requiring the user to solve a CAPTCHA in order to generate a single code be sufficient to prevent this form of attack?