From f4177baed527ddfbee0611edceefcfc18ce30a9f Mon Sep 17 00:00:00 2001 From: gorkem-bwl Date: Fri, 10 Jul 2026 00:06:31 +0300 Subject: [PATCH 1/2] fix(server): raise express.json body limit to 10mb MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Express defaults to a 100kb JSON body, which is too small for realistic imports through POST /api/v1/monitors/import/json (backups with many monitors and their config easily exceed 100kb, returning "request entity too large"). Raise the parser cap to 10mb. That covers real-world import payloads while keeping the DoS surface bounded — a larger, streaming file-upload route for imports remains desirable as a follow-up. --- server/src/app.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/server/src/app.ts b/server/src/app.ts index 2ed1c2f01..bf8c140c1 100644 --- a/server/src/app.ts +++ b/server/src/app.ts @@ -54,7 +54,7 @@ export const createApp = ({ app.use(express.static(frontendPath)); - app.use(express.json()); + app.use(express.json({ limit: "10mb" })); app.use(cookieParser()); app.use(sanitizeBody()); From 9459edce004252cace4d7db35fe291a799fe49e9 Mon Sep 17 00:00:00 2001 From: gorkem-bwl Date: Sat, 11 Jul 2026 04:22:42 +0300 Subject: [PATCH 2/2] scope 10mb body limit to /monitors/import/json only Address review feedback: keep the global express.json() at the default 100kb and mount a route-scoped 10mb parser in front of it for /api/v1/monitors/import/json. Express matches middleware in registration order, so the import route uses the larger parser and every other endpoint keeps the tight default. No change in DoS surface for normal traffic. --- server/src/app.ts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/server/src/app.ts b/server/src/app.ts index bf8c140c1..12c88d5f6 100644 --- a/server/src/app.ts +++ b/server/src/app.ts @@ -54,7 +54,8 @@ export const createApp = ({ app.use(express.static(frontendPath)); - app.use(express.json({ limit: "10mb" })); + app.use("/api/v1/monitors/import/json", express.json({ limit: "10mb" })); + app.use(express.json()); app.use(cookieParser()); app.use(sanitizeBody());