Proxy preauth could be able to mitigate a vulnerable framework. The idea is that you never connect to the application server itself, but to a proxy that requires a separate authentication. That’s obviously not possible for a public-facing application.

Now, if the attacker has access to the proxy authentication, all of this doesn’t help much, but at least you could track and limit who can access what chunks.