diff --git a/internal/federationdomain/endpoints/login/login_handler.go b/internal/federationdomain/endpoints/login/login_handler.go
index 04e077c38..9d99842e0 100644
--- a/internal/federationdomain/endpoints/login/login_handler.go
+++ b/internal/federationdomain/endpoints/login/login_handler.go
@@ -1,4 +1,4 @@
-// Copyright 2022-2024 the Pinniped contributors. All Rights Reserved.
+// Copyright 2022-2026 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package login
@@ -52,6 +52,8 @@ func NewHandler(
 	auditLogger plog.AuditLogger,
 ) http.Handler {
 	loginHandler := httperr.HandlerFunc(func(w http.ResponseWriter, r *http.Request) error {
+		r.Body = http.MaxBytesReader(w, r.Body, 1<<20) // 1 MB limit
+
 		if err := auditLogger.AuditRequestParams(r, paramsSafeToLog()); err != nil {
 			plog.DebugErr("error parsing callback request params", err)
 			return httperr.New(http.StatusBadRequest, "error parsing request params")
diff --git a/internal/federationdomain/endpoints/login/login_handler_test.go b/internal/federationdomain/endpoints/login/login_handler_test.go
index a1a0deb6f..c70e6132e 100644
--- a/internal/federationdomain/endpoints/login/login_handler_test.go
+++ b/internal/federationdomain/endpoints/login/login_handler_test.go
@@ -4,6 +4,7 @@
 package login
 
 import (
+	"io"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
@@ -116,6 +117,8 @@ func TestLoginEndpoint(t *testing.T) {
 		method         string
 		path           string
 		csrfCookie     string
+		contentType    string
+		formParams     url.Values
 		getHandlerErr  error
 		postHandlerErr error
 
@@ -350,6 +353,17 @@ func TestLoginEndpoint(t *testing.T) {
 			wantEncodedState: happyState,
 			wantDecodedState: expectedHappyDecodedUpstreamStateParam(),
 		},
+		{
+			name:            "POST with body too large",
+			method:          http.MethodPost,
+			path:            happyPathWithState,
+			csrfCookie:      happyCSRFCookie,
+			contentType:     "application/x-www-form-urlencoded",
+			formParams:      map[string][]string{"k": {strings.Repeat("v", 1_048_576)}},
+			wantStatus:      http.StatusBadRequest,
+			wantContentType: htmlContentType,
+			wantBody:        "Bad Request: error parsing request params\n",
+		},
 		{
 			name:             "happy GET request with err param which can be set by the real POST handler on redirects back to the GET handler",
 			method:           http.MethodGet,
@@ -461,10 +475,19 @@ func TestLoginEndpoint(t *testing.T) {
 		t.Run(test.name, func(t *testing.T) {
 			t.Parallel()
 
-			req := httptest.NewRequestWithContext(t.Context(), test.method, test.path, nil)
+			var body io.Reader
+			if test.method == http.MethodPost && len(test.formParams) > 0 {
+				body = strings.NewReader(test.formParams.Encode())
+			}
+
+			req := httptest.NewRequestWithContext(t.Context(), test.method, test.path, body)
+
 			if test.csrfCookie != "" {
 				req.Header.Set("Cookie", test.csrfCookie)
 			}
+			if test.contentType != "" {
+				req.Header.Set("Content-Type", test.contentType)
+			}
 			req, _ = auditid.NewRequestWithAuditID(req, func() string { return "fake-audit-id" })
 			rsp := httptest.NewRecorder()