This seems easy to defend against for sites that don't accept a lot of POST data. You could set a really low threshold for content-length. You could maybe even get fancy and only allow large POST data on certain URLs (e.g. low POST content-length threshold on www.example.com, but a higher threshold on admin.example.com; assuming that you can reject the connection as unauthenticated before receiving the data).