From 9459edce004252cace4d7db35fe291a799fe49e9 Mon Sep 17 00:00:00 2001
From: gorkem-bwl <gorkem.cetin@bluewavelabs.ca>
Date: Sat, 11 Jul 2026 04:22:42 +0300
Subject: [PATCH] scope 10mb body limit to /monitors/import/json only

Address review feedback: keep the global express.json() at the default
100kb and mount a route-scoped 10mb parser in front of it for
/api/v1/monitors/import/json. Express matches middleware in registration
order, so the import route uses the larger parser and every other
endpoint keeps the tight default. No change in DoS surface for normal
traffic.
---
 server/src/app.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/server/src/app.ts b/server/src/app.ts
index bf8c140c1..12c88d5f6 100644
--- a/server/src/app.ts
+++ b/server/src/app.ts
@@ -54,7 +54,8 @@ export const createApp = ({
 
 	app.use(express.static(frontendPath));
 
-	app.use(express.json({ limit: "10mb" }));
+	app.use("/api/v1/monitors/import/json", express.json({ limit: "10mb" }));
+	app.use(express.json());
 	app.use(cookieParser());
 
 	app.use(sanitizeBody());