diff --git a/test/component/Elsa.Workflows.ComponentTests/Scenarios/Activities/Http/HttpEndpointSecurityAndEdgeCasesTests.cs b/test/component/Elsa.Workflows.ComponentTests/Scenarios/Activities/Http/HttpEndpointSecurityAndEdgeCasesTests.cs
index fe9921f33..4f48af4f0 100644
--- a/test/component/Elsa.Workflows.ComponentTests/Scenarios/Activities/Http/HttpEndpointSecurityAndEdgeCasesTests.cs
+++ b/test/component/Elsa.Workflows.ComponentTests/Scenarios/Activities/Http/HttpEndpointSecurityAndEdgeCasesTests.cs
@@ -51,40 +51,36 @@ public class HttpEndpointSecurityAndEdgeCasesTests(App app) : AppComponentTest(a
         var longUserId = new string('a', 1000); // Very long user ID
         var longOrderId = new string('b', 1000); // Very long order ID
 
-        // Act & Assert - Should not crash, might return 404 or handle gracefully
+        // Act & Assert - Should not crash
         var response = await client.GetAsync($"test/users/{longUserId}/orders/{longOrderId}");
         
         // The exact response depends on server configuration, but it shouldn't crash
-        Assert.True(response.StatusCode == HttpStatusCode.NotFound || 
-                   response.StatusCode == HttpStatusCode.BadRequest ||
-                   response.StatusCode == HttpStatusCode.RequestUriTooLong ||
-                   response.StatusCode == HttpStatusCode.OK);
+        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
     }
 
     [Fact]
-    public async Task HttpEndpoint_MalformedMultipartData_HandlesGracefully()
+    public async Task HttpEndpoint_MalformedMultipartData_RejectsBadRequest()
     {
         // Arrange
         var client = WorkflowServer.CreateHttpWorkflowClient();
         
-        // Create properly malformed multipart content by using StringContent with manually crafted headers
+        // Create malformed multipart content that violates RFC 7578 - incomplete boundary structure
         var malformedContent = new StringContent(
-            "--boundary\r\nContent-Disposition: form-data; name=\"test\"\r\n\r\nvalue\r\n--boundary--", 
+            "not-multipart-at-all-just-plain-text", 
             Encoding.UTF8);
         
-        // Manually set the content type header to avoid client-side validation
+        // Set multipart/form-data content-type but with plain text content
         malformedContent.Headers.ContentType = new("multipart/form-data")
         {
-            Parameters = { new System.Net.Http.Headers.NameValueHeaderValue("boundary", "boundary") }
+            Parameters = { new System.Net.Http.Headers.NameValueHeaderValue("boundary", "test-boundary") }
         };
 
         // Act
         var response = await client.PostAsync("test/file-upload", malformedContent);
 
-        // Assert - Should handle gracefully without crashing
-        Assert.True(response.StatusCode == HttpStatusCode.BadRequest || 
-                   response.StatusCode == HttpStatusCode.OK ||
-                   response.StatusCode == HttpStatusCode.InternalServerError);
+        // Assert - Should reject malformed multipart data with InternalServerError
+        // The system detects malformed multipart structure and throws IOException during parsing
+        Assert.Equal(HttpStatusCode.InternalServerError, response.StatusCode);
     }
 
     [Fact]
@@ -93,15 +89,16 @@ public class HttpEndpointSecurityAndEdgeCasesTests(App app) : AppComponentTest(a
         // Arrange
         var client = WorkflowServer.CreateHttpWorkflowClient();
         var request = new HttpRequestMessage(HttpMethod.Get, "test/query-headers");
-        request.Headers.Add("X-Large-Header", new string('x', 8192)); // Very large header
-
-        // Act & Assert - Should handle gracefully
+        
+        // Test with a large but reasonable header (16KB)
+        var largeHeaderValue = new string('x', 16384);
+        request.Headers.Add("X-Large-Header", largeHeaderValue);
+        
+        // Act
         var response = await client.SendAsync(request);
         
-        // Response might be successful or might be rejected by server, but shouldn't crash
-        Assert.True(response.StatusCode == HttpStatusCode.OK || 
-                   response.StatusCode == HttpStatusCode.BadRequest ||
-                   response.StatusCode == HttpStatusCode.RequestHeaderFieldsTooLarge);
+        // Assert - System should handle large headers successfully
+        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
     }
 
     [Fact]