How to approach security?

[adrianrudnik]

Given that IPX is the default and I'm trying to run a simple node server SSR enabled application with images, what mechanisms are there to prevent someone to run a simple

curl https://.../_ipx/enlarge,s_10000x1000&w_10000&q_100/someimage.jpg

Because right now, in production, I can hold a CPU hostage for good 20 seconds and produce a > 40mb image per request.

I only found mentions of the nonce, but that seems to be CSP only and does not prevent malicious configurations or scripts.