[chmike]

I suggested the certificate solution but it's far from being lightweight. I found a simpler solution that may fit some use cases.

The client sends a request, the server returns a response that may be big that also contains a random value. The client must return this random value in a thank you message.

If the server doesn't receive the thank you message, it slows down responses to that ip address and eventually blacklist it if it's repeated.

From the client perspective, the answer is obtained in one round trip time. The price to pay on the server is the need to keep track of the expected thank you messages, and the throttled or blacklisted addresses.