maximum input length config

[markhuge]

👋 Hi, is there any config for maximum input payload size? Thinking through mitigating a bad actor attempting to do something like send GBs of data as a password.

I see #2396 with an open item for max password length, but was curious if there's anything I could be doing to mitigate this (or if it's a non-issue because of something else I've missed).

[aeneasr]

We would recommend to use a reverse proxy in front which limits the HTTP request size to e.g. 4MB to prevent also excessive sizes of the Identity Traits!

Regarding passwords, those are hashed and have a fixed size result.