文件上传，限制大小最佳做法[关闭]

Question

Hello developers every where,

i saw many articles and reddit posts about uploading best practices (this one of the posts)

the point i'm asking for is "Restrict file size. Not just big files, but small files. (DDOS yo!)", what does that mean?

is that mean that i have to make if condition in my code to check if size == 0 || size > max_size to show error message?

becase i can't add minimum limit of my files, i can't say that the minimun file size will be 1 Kb, because it may be very small text file or image.

so, what is the best practice to do that?

Answer 1

Generally speaking, it is a good idea to make sure that content that gets uploaded to your website meets minimum qualifications. Usually those restrictions are specific for each file type. Ex: resolution is at least 640x480 for images, file is not empty(hence minimum size limit), file header matches file extension etc.

Additionally, some hosts limit number of files that you can have on your file system. Putting minimum size prevents people from writing a script that will instantly deplete your server's limits, or flood it with requests.

All limits are set on case-by-case basis depending on your project requirements to protect users from themselves.