title: aspnet:MaxJsonDeserializerMembers vs maxRequestLength
body: <p>I am running into errors like <strong>The JSON request was too large to be deserialized.</strong>.</p>
  
  <p>Quick search on stackoverflow tells you that you should set appSetting <strong>aspnet:MaxJsonDeserializerMembers</strong> to be higher to fix the issue. However, the <a href="https://msdn.microsoft.com/en-us/library/hh975440(v=vs.120).aspx" rel="noreferrer">msdn</a> documentation on the appSettings says </p>
  
  <pre><code>  Caution
    Setting this attribute to too large a number can pose a security risk.
  </code></pre>
  
  <p>I would expect that you are cautioned against setting this value to higher numbers to prevent anyone from submitting large payloads that could impact your system. However, given that I am already setting the value of <strong>maxRequestLength</strong> to a large number, will changing the <strong>aspnet:MaxJsonDeserializerMembers</strong> value have any other security implications?</p>
  
  <p>I do not see how 1001 small json members could pose any more security threat that a single large json object.</p>