Forcing 413 Content Too Large

Mechanism: Per RFC 9110 §15.5.14, if the application enforces size limits after resolving the resource, existing resources return 413 while non-existing ones return 404.

Isolated Variable: Only the payload size changes.

Oracle Signal: 413 (exists, per-resource limit hit) vs 404 (does not exist).

PUT — Existing Resource (Oversized Body)

PUT /api/users/1001/avatar HTTP/1.1
Host: target.com
Content-Type: application/octet-stream
Content-Length: 10485760

<10 MB of binary data>

HTTP/1.1 413 Content Too Large
Content-Type: application/json

{"error": "Content Too Large", "detail": "Maximum upload size is 5 MB"}

PUT — Non-Existing Resource (Oversized Body)

PUT /api/users/9999/avatar HTTP/1.1
Host: target.com
Content-Type: application/octet-stream
Content-Length: 10485760

<10 MB of binary data>

HTTP/1.1 404 Not Found
Content-Type: application/json

{"error": "Not Found"}

Mitigation: Enforce body size limits at the reverse proxy or global middleware layer before routing to resource-specific handlers.