enumeration-prevention.cs

try
{
    using (var client = _clientFactory.CreateClient("captcha"))
    {
        var response = await client.PostAsync("recaptcha/api/siteverify", new FormUrlEncodedContent(new Dictionary<string, string> { { "secret", _captchaSettings.Value.Secret }, { "response", model.Token }, { "remoteip", Request.HttpContext.Connection.RemoteIpAddress?.ToString() } }), ct);
        response.EnsureSuccessStatusCode();
        var captchaResponse = await response.Content.ReadAsAsync<CaptchaResponse>(ct);
        if (!captchaResponse.Success)
        {
            ModelState.AddModelError(nameof(model.Email), "Invalid captcha");
            _logger.LogWarning($"Invalid captcha doing business logic - {model.Email} - {captchaResponse.Hostname}");
            return ValidationProblem(ModelState);
        }
    }
    while (!RunningRequests.TryAdd(HttpContext.Connection.RemoteIpAddress.ToString(), true))
        await Task.Delay(3000, ct);
    await Task.Delay(3000, ct);
    //business logic
}
catch (Exception ex)
{
    _logger.LogError(ex, "Error doing the business logic");
    throw;
}
finally
{
    RunningRequests.Remove(HttpContext.Connection.RemoteIpAddress.ToString(), out var _);
}
return Json(results);