> Issue #2 Arbitrary size limits.[...] > A reasonable choice might be 2^24-1 bytes, the largest possible certificate How does one treat untrusted input whose

> Issue #2 Arbitrary size limits.[...] > A reasonable choice might be 2^24-1 bytes, the largest possible certificate How does one treat untrusted input whose length might exceed available memory? I am working on a patch for a jwks implementation which does not even have upper bounds in the spec. Accepting any valid input until OOMing seems like a suboptimal solution.