diff --git a/file-service/src/main/java/com/xuqm/file/config/SecurityConfig.java b/file-service/src/main/java/com/xuqm/file/config/SecurityConfig.java
index 9e8ee15..f9792da 100644
--- a/file-service/src/main/java/com/xuqm/file/config/SecurityConfig.java
+++ b/file-service/src/main/java/com/xuqm/file/config/SecurityConfig.java
@@ -36,12 +36,12 @@ public class SecurityConfig {
             .sessionManagement(sm -> sm.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
             .authorizeHttpRequests(auth -> auth
                 .requestMatchers(HttpMethod.OPTIONS, "/**").permitAll()
-                // Public: serve files by hash and thumbnails
-                .requestMatchers("/api/file/*/thumbnail").permitAll()
-                .requestMatchers("/api/file/*").permitAll()
+                // Public: serve files by hash and thumbnails (GET only — upload requires auth)
+                .requestMatchers(HttpMethod.GET, "/api/file/*/thumbnail").permitAll()
+                .requestMatchers(HttpMethod.GET, "/api/file/*").permitAll()
                 // Actuator health & info
                 .requestMatchers("/actuator/**").permitAll()
-                // Upload requires authentication
+                // Everything else (including POST /api/file/upload) requires authentication
                 .anyRequest().authenticated()
             )
             .exceptionHandling(ex -> ex