[Security] Enforce maximum username length

Author: javiereguiluz

security.rst

@@ -343,6 +343,11 @@ can also create your own :ref:`custom user provider <security-custom-user-provid
     it using the :class:`Symfony\\Component\\Security\\Core\\User\\UserProviderInterface`
     type-hint.
 
+.. note::
+
+    The maximum length allowed for the user identifier is 4096 characters to
+    prevent `session storage flooding`_ attacks.
+
 .. _security-encoding-user-password:
 
 Registering the User: Hashing Passwords
@@ -2656,3 +2661,4 @@ Authorization (Denying Access)
 .. _`SymfonyCastsVerifyEmailBundle`: https://github.com/symfonycasts/verify-email-bundle
 .. _`HTTP Basic authentication`: https://en.wikipedia.org/wiki/Basic_access_authentication
 .. _`Login CSRF attacks`: https://en.wikipedia.org/wiki/Cross-site_request_forgery#Forging_login_requests
+.. _`session storage flooding`: https://symfony.com/blog/cve-2016-4423-large-username-storage-in-session