title: REST service and race conditions
body: <p>Let's imagine a problem:
  I have a REST service, which is implemented using Java/MySQL/Spring and HTTP/JSON technologies.
  The clients of the REST service are mobile applications. 
  So it's possible that someone will decompile the code and will get the API of the REST service.
  ( Yes, the code is obfuscated etc, but anyway ).</p>
  
  <p>Problem: there is a POST method to send money to other user of the application.
  I am worried, that someone can get the API, write a bot and make this POST request 500 or 5,000 or even 50,000 times per second.
  As a result, he might send more money than he actually has, because if 1000 requests are processed simultaneously then the balance checking might be
  successful for all 1000 request, however the real amount of money on an account might be enough only for, lets say, 50 requests.</p>
  
  <p>So, basically, it's more like the standard "race" condition with multiple threads.
  The problem is, that I have multiple servers and they are not related with each other anyhow.
  So, 300 request can come to server A, 300 requests can come to server B and rest requests can come to server C.</p>
  
  <p>The best idea what I have is to use something like "SELECT ... FOR UPDATE" and synchronize on database level.
  However, I would like to consider another solutions.</p>
  
  <p>Any ideas or suggestions?</p>