Forcing 413 Content Too Large

Mechanism: Per RFC 9110 §15.5.14, if the application enforces size limits after resolving the resource, existing resources return 413 while non-existing ones return 404.

Isolated Variable: Only the payload size changes.

Oracle Signal: 413 (exists, per-resource limit hit) vs 404 (does not exist).

PATCH — Existing Resource (Oversized JSON)

PATCH /api/users/1001 HTTP/1.1
Host: target.com
Content-Type: application/json
Content-Length: 1048576

{"bio": "AAAA..."}

(1 MB of repeated characters in the bio field)

HTTP/1.1 413 Content Too Large
Content-Type: application/json

{"error": "Content Too Large", "detail": "Request body exceeds 100 KB limit"}

PATCH — Non-Existing Resource (Oversized JSON)

PATCH /api/users/9999 HTTP/1.1
Host: target.com
Content-Type: application/json
Content-Length: 1048576

{"bio": "AAAA..."}

HTTP/1.1 404 Not Found
Content-Type: application/json

{"error": "Not Found"}

Mitigation: Enforce body size limits at the reverse proxy or global middleware layer before routing to resource-specific handlers.