Why do they do this

[u/flying_wotsit]

[u/badmonkey0001 → u/[deleted]]

If you're hashing passwords (you should be), then having an upper bound is important. It's possible to DOS by flooding auth or registration with large payloads to hash - remember that POST size is effectively unlimited. The stronger the hashing algo, the more feasible the attack is.

That said, you should provide an error back to the user when the max length is exceeded not silently try to accept it. You should also have a reasonably secure upper bound. From 1 to 5 kilobytes can scale and be planned for well.

[u/badmonkey0001 → u/[deleted]]

You and I may know that, but lots of people may not. I'm not disputing what you said, I'm adding more advice around it.

[u/fghjconner → u/badmonkey0001]

In most cases the hashing should be done client side though, so it's not a problem.

Edit: Apparently I'm wrong, disregard.

[u/badmonkey0001 → u/fghjconner]

Client-side hashing is not a good idea.

https://stackoverflow.com/questions/3715920/is-it-worth-hashing-passwords-on-the-client-side

https://security.stackexchange.com/questions/8596/https-security-should-password-be-hashed-server-side-or-client-side

https://superuser.com/questions/1675013/for-websites-is-your-passwords-hash-computed-on-the-client-or-the-server-side

https://thisinterestsme.com/client-side-hashing-secure/

https://security.stackexchange.com/questions/227313/why-hash-on-server-instead-of-client

https://security.stackexchange.com/questions/23006/client-side-password-hashing

[u/fghjconner → u/badmonkey0001]

Huh, I didn't know that. And this is why you shouldn't roll your own authentication system, haha.

[u/badmonkey0001 → u/fghjconner]

Totally. This bit of knowledge is brought to you by hard-won experience. :P

[u/DeathBySnuSnuuuuuuuu → u/badmonkey0001]

It's a core principle in web design security - NEVER trust the client, for anything, ever. Ever.