This is a backend concern, not a frontend one. The backend shouldn’t naively accept input without making sure the input is within the backend’s limitations.
Client side validation does not replace server side validation, and vice versa. Just because you validate server side doesn’t mean you can’t also do it client side and avoid a round trip.
I guess? But if someone puts in a ten megabyte password they are either suffering a bug or blatantly screwing with you. It's okay to throw a 400 error at them.
