Forcing 412 Precondition Failed

Mechanism: Per RFC 9110 §13.1.1, if the If-Match value doesn't match any current representation's ETag, the server MUST return 412. The server must locate the resource to compare ETags.

Isolated Variable: Only the If-Match header is added with a fabricated ETag value.

Oracle Signal: 412 (exists) vs 404 (does not exist).

PUT — Existing Resource

PUT /api/users/1001 HTTP/1.1
Host: target.com
Content-Type: application/json
If-Match: "bogus-etag-value"
Content-Length: 27

{"name": "test", "age": 30}

HTTP/1.1 412 Precondition Failed
Content-Type: application/json

{"error": "Precondition Failed", "detail": "ETag mismatch"}

PUT — Non-Existing Resource

PUT /api/users/9999 HTTP/1.1
Host: target.com
Content-Type: application/json
If-Match: "bogus-etag-value"
Content-Length: 27

{"name": "test", "age": 30}

HTTP/1.1 404 Not Found
Content-Type: application/json

{"error": "Not Found"}

💡 Wildcard variant (If-Match: *): * matches any current representation, so an existing resource passes and the server attempts the operation. A non-existing resource returns 412. The successful branch mutates state — use fabricated ETags to avoid unintended writes.

Mitigation: Return 404 for non-existent resources before evaluating precondition headers.