diff --git a/docs/ja-JP/skills/tinystruct-patterns/SKILL.md b/docs/ja-JP/skills/tinystruct-patterns/SKILL.md
index 20116dd8f..82e88fe28 100644
--- a/docs/ja-JP/skills/tinystruct-patterns/SKILL.md
+++ b/docs/ja-JP/skills/tinystruct-patterns/SKILL.md
@@ -136,12 +136,23 @@ public class MyService extends AbstractApplication {
 ```
 
 ### HTTPモード分岐（login）
+
+以下の長さ制限は UTF-16 コード単位で数えるアプリケーション側の設定例であり、tinystruct のデフォルトではありません。認証サービスの方針に合わせてください。空白だけの認証情報は拒否しますが、認証に渡す値をトリミングしたり変更したりしません。
+
 ```java
 @Action(value = "login", mode = Mode.HTTP_POST)
 public String doLogin(Request<?, ?> request) throws ApplicationException {
     String username = request.getParameter("username");
     String password = request.getParameter("password");
 
+    final int maxUsernameLength = 256;
+    final int maxPasswordLength = 1024;
+    if (username == null || password == null
+            || username.length() > maxUsernameLength || password.length() > maxPasswordLength
+            || username.isBlank() || password.isBlank()) {
+        throw new ApplicationException("Invalid credentials");
+    }
+
     // AuthService はアプリケーション独自のクラスであり、tinystruct の一部ではない
     String userId = AuthService.getInstance().authenticate(username, password); // 失敗時は null
     if (userId == null) {
diff --git a/skills/tinystruct-patterns/SKILL.md b/skills/tinystruct-patterns/SKILL.md
index b3c30d167..ec8a6ca12 100644
--- a/skills/tinystruct-patterns/SKILL.md
+++ b/skills/tinystruct-patterns/SKILL.md
@@ -136,12 +136,23 @@ public class MyService extends AbstractApplication {
 ```
 
 ### HTTP Mode Disambiguation (login)
+
+The limits below are example application policy measured in UTF-16 code units, not tinystruct defaults. Align them with your authentication service. Reject blank credentials without trimming or otherwise changing the values passed to authentication.
+
 ```java
 @Action(value = "login", mode = Mode.HTTP_POST)
 public String doLogin(Request<?, ?> request) throws ApplicationException {
     String username = request.getParameter("username");
     String password = request.getParameter("password");
 
+    final int maxUsernameLength = 256;
+    final int maxPasswordLength = 1024;
+    if (username == null || password == null
+            || username.length() > maxUsernameLength || password.length() > maxPasswordLength
+            || username.isBlank() || password.isBlank()) {
+        throw new ApplicationException("Invalid credentials");
+    }
+
     // AuthService is your application's own class, not part of tinystruct
     String userId = AuthService.getInstance().authenticate(username, password); // null on failure
     if (userId == null) {