title: How to Limit web requests per second to avoid spamming and denial of service
body: <p>I have a web-page which takes user's search query and searches it in the database. As this query is time consuming, even with proper indexes in place, I want to limit the search requests to, say, 1 per 2 seconds per user. Currently I am using the following method(Rough sketch)</p>
  
  <p><strong>LIMITATIONS:</strong><br>
  <strong>1) There is no login system in my website. Rather, I am depending upon the request headers to get the ip address and user id of the user.</strong></p>
  
  <p><strong>Algo:</strong>  </p>
  
  <pre><code>1) Maintain a map of ips and user ids and their latest search timestamp.
  2) For every search request, 
     2.1) If user has searched in last two seconds: Show error message
     2.2) Else, allow him to search
  </code></pre>
  
  <p>I want to know is this method adequate? As both the ip address and user id is coming from the request header, is it possible for spammers to change the request headers?</p>