RFC 10008, published by the IETF in June 2026, introduces the HTTP QUERY method — a new verb that combines GET's safety and idempotency semantics with POST's ability to carry a request body. This resolves a long-standing dilemma where developers had to choose between GET (limited URI length, sensitive data in logs) and POST (no caching, broken semantics) for complex search queries. QUERY supports content negotiation via the Accept-Query header, body-based caching with normalization caveats, proper redirect handling, and conditional requests. It has significant implications for GraphQL (enabling edge caching without persisted queries), WAF configuration, CORS preflight handling, and GDPR compliance. Backend support already exists in Node.js 21+/22+, Go 1.22+, and OpenAPI 3.2+, though broad ecosystem adoption across proxies, CDNs, and browsers will take years.
Table of contents
The genesis of a standard: AUTH48 and the role of the IETFThe problem: physical and semantic limits of GET and POSTWebDAV precursors and why to avoid SEARCH or REPORTDiscovery and the Accept-Query headerThe concept of “equivalent resource”Redirect management and conditional requestsEdge network engineering: body-based cachingSecurity, privacy, and CORS preflightA finally mature protocol?21.6K Impressions2 Comments