[lesuorac]

Why not either show an error or do a client-side hash so there's a fixed length?

[orblivion]

Showing an error is probably the right thing. Client-side mitigations wouldn't prevent a DOS.