The way that assets are resized and cropped enables any user to potentially overflow the server

[hsensh]

I was looking into the way assets are cropped and resized, and I think the preview presets are a genius idea to handle different preset images, however, the fact that I can, without any admin authentication, do this: https://asset-url/?w=50&h=50&mode=crop, I can do a million of these calls with different sizes through any script, and potentially overflow the server with unsolicited files. A non-authenticated user should not be allowed to add new files to the server if it doesn't have the right to, especially when this cannot be controlled or limited from within the configuration as far as I could see, right? All that aside from the actual processing power it takes to resize and crop images on the fly which could also overflow the CPU or RAM potentially.

I would suggest for us to have the option to limit these operations to just presets from the configuration, that way we wouldn't be forced to expose such a resource consuming feature publicly

[dlhck]

There is something called Signed URLs that basically mitigate that risk.

A signed URL is a URL that provides limited permission and time to make a request.