title: Best practice in securing user creation for a REST API
body: <p>I'm currently working on a iphone/android project where the mobile talk ta java backend server through REST API calls.</p>
  
  <p>The Java backend is done using Spring and its Authentication system (with a JSESSION ID token)</p>
  
  <p>I'm not an expert in security but I can see that if not implemented correctly there could be quite a lot of issues.</p>
  
  <p>One of my biggest concern would be user creation for example. 
  When the app creates a user it simply makes a POST request to (url.com/rest/create)</p>
  
  <p>How can I avoid, server side, that a malicious user puts this url in a loop and create thousands of users ?</p>
  
  <p>What are common best practices to secure API calls ? 
  Is the Spring Authentication token enough ?</p>
  
  <p>Thank you!</p>