From 07b0299438e2ca7ee7b291399aa29a977074fc8b Mon Sep 17 00:00:00 2001 From: cc Date: Wed, 24 Jun 2026 21:15:52 +0800 Subject: [PATCH] fix(web): scope 16MB body limit to photo routes only Co-Authored-By: Claude Opus 4.8 --- Server/src/routes/web.rs | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/Server/src/routes/web.rs b/Server/src/routes/web.rs index 65b8ee4..d546997 100644 --- a/Server/src/routes/web.rs +++ b/Server/src/routes/web.rs @@ -37,14 +37,19 @@ pub fn router(state: AppState) -> Router { .allow_methods([Method::GET, Method::POST, Method::DELETE]) .allow_headers([header::CONTENT_TYPE, header::AUTHORIZATION]); + // 照片接口接收 base64 上传，需放宽 body 上限到 16MB；其余接口保持 + // axum 默认 2MB，避免全站放大攻击面。故把照片路由单独成子路由再 merge。 + let photo_routes = Router::new() + .route("/api/web/photos", get(list_photos).post(upload_photo)) + .route("/api/web/photos/{id}", get(get_photo).delete(delete_photo)) + .layer(DefaultBodyLimit::max(16 * 1024 * 1024)); + Router::new() .route("/api/web/stats", get(stats)) .route("/api/web/gate", post(gate)) .route("/api/web/login", post(login)) .route("/api/web/weather", get(weather)) - .route("/api/web/photos", get(list_photos).post(upload_photo)) - .route("/api/web/photos/{id}", get(get_photo).delete(delete_photo)) - .layer(DefaultBodyLimit::max(16 * 1024 * 1024)) + .merge(photo_routes) .layer(cors) .with_state(state) }