im not sure exactly abt your environment. but assuming that you host a Next.js instance on serverfull or managed env where the instance lives long, you can use a cookie to store uuid and manage a hash in JS global variable in the server side. it's naive solution. keep in mind it won't work as DoS protection as http headers can be spoofed easily.

having Cloudflare Worker in front of the VPS works but won't work for DDoS.

i think the easiest solution would be to just fetch the api client side

usually it’s called throttling

hmm, could it work to use apache and nginx together and then configure ratelimiting with nginx?

im currently using apache

Apache? you mean HTTP server, which used to be a popular reverse proxy for Tomcat Java Servelet?

i mean this apache

idk if its the same

wow. yeah, it is. amazing.

hmm, if you think it'll be good i'll give apache and nginx together a try

i mean it’s outdated tech stack. just i remember i used to work with those tech. usually you don’t need it as we can employ Vercel, Cloudflare, Supabase and so on. Cloudflare replaces Nginx with Pingora, which is Rust Tokio reverse proxy

you might want to study what reverse proxy is. i would recommend you to play around with Cloudflare Worker, you will get ideas

alright ty, about ddos protection with cloudflare: i cant say its the best