This is a great post, thank you!
One thing you try to improve security is to have the POST Handler in an ORDS module secured using OAuth2. Use apex_web_service.oauth_authenticate to get a token and then include the following in the CKEditor initialization to pass the bearer token:
withCredentials: true,
headers: {Authorization: 'Bearer &P10_OAUTH_TOKEN.'}
Having the POST handler secured by OAuth2 also allows other services to use it, not just APEX.
Keep the GET image handler in an unsecured ORDS Handler. Generate a random token when you add the image to the table. Append the token as a query string parameter to the URL returned in the POST response e.g.
{
"url": "example.com/ords/get_ck_image/file/10
}
This way, images included in the HTML will show in a classic report, etc.
<img src="example.com/ords/get_ck_image/file/13
In the GET handler, include the token in the where clause:
select content_type, image
from ckeditor_images
where id = :id
and image_token = :image_token
This isn't completely secure because someone could inspect the HTML and share the link. It does prevent people from trying to guess other image tokens though.