pub const MAX_JTI_BYTES: usize = 512;Expand description
The longest jti either window takes, in bytes.
A jti is the caller’s own string, and a window keeps it for as long as
its proof lives. Real clients send 16 to 36 bytes: jacquard’s DPoP proofs
carry 16 base64url characters, didbot-agentd’s tree proofs 32 hex
digits, and a UUID is 36 characters. 512 is more than ten times the
longest of those. A proof with a longer one is refused before it is kept.