Implementation guide
OWASP AISVS v1.01
Input Validation · Prompt Injection Defenses
Reject input that is too long
Verify that input length controls prevent content from exceeding the context window. The controls must reject inputs that exceed token limits rather than truncating them.
OWASP AISVS v1.01, requirement 2.1.4
In plain English
Set a limit on how much text each input may contain, and refuse anything over it. Do not trim it to fit. Trimming can push your own instructions or safety rules out of the model's context and leave the attacker's text in charge.
What good looks like
- Limits are counted in tokens, using the tokeniser for the model you call.
- There are limits per source (the user's message, each document, the whole prompt), with room reserved for your instructions and the reply.
- Input over the limit is rejected with a clear error and logged.
- Where long conversations are shortened, a written rule decides what is dropped, and your instructions always stay.
How teams usually do it
- Count tokens where the prompt is assembled, with the provider's tokeniser library or token-counting endpoint (for example tiktoken for OpenAI models).
- Add a request size limit at the API gateway as an outer cap.
- Split and summarise long documents in a separate step, so no single prompt has to hold everything.
Suggested evidence
- The configured limits for each input source.
- Tests showing an over-limit input is rejected whole.
- The prompt assembly code, showing where your instructions sit and that they are never trimmed.
Common mistakes
- Limiting characters. The same number of characters can be far more tokens in some languages, or in text crafted to tokenise badly.
- Assuming the provider will return an error. Some frameworks and conversation-memory helpers trim history silently, so check what yours does.
- Applying the limit to what the user types and forgetting retrieved documents and tool output.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.