Forcing 412 Precondition Failed

Mechanism: Per RFC 9110 §13.1.1, if the If-Match value doesn't match any current representation's ETag, the server MUST return 412. The server must locate the resource to compare ETags. The precondition failure should prevent actual deletion.

Isolated Variable: Only the If-Match header is added with a fabricated ETag value.

Oracle Signal: 412 (exists) vs 404 (does not exist).

DELETE — Existing Resource

DELETE /api/users/1001 HTTP/1.1
Host: target.com
If-Match: "bogus-etag-value"

HTTP/1.1 412 Precondition Failed
Content-Type: application/json

{"error": "Precondition Failed"}

DELETE — Non-Existing Resource

DELETE /api/users/9999 HTTP/1.1
Host: target.com
If-Match: "bogus-etag-value"

HTTP/1.1 404 Not Found
Content-Type: application/json

{"error": "Not Found"}

💡 Wildcard variant (If-Match: *): * matches any current representation, so an existing resource passes and the server attempts the DELETE — actually deleting it. A non-existing resource returns 412. The successful branch destroys the resource. Use fabricated ETags to confirm existence non-destructively.

Mitigation: Return 404 for non-existent resources before evaluating precondition headers.