HTTP QUERY Shipped. Your Cache Did Not Get the Memo

RFC 10008, published June 2026, introduces the HTTP QUERY method — the first new HTTP method since PATCH in 2010. QUERY is safe, idempotent, and cacheable like GET, but carries a request body like POST, solving the long-standing problem of structured search payloads too large for query strings. The critical infrastructure catch: caches must key on the request body and related metadata, which no browser and few managed CDNs (e.g., CloudFront only allows a fixed seven methods) support by default yet. The RFC includes a built-in escape hatch — respond with Content-Location pointing to a cacheable GET URL, letting existing infrastructure handle caching. Practical gotchas covered include the browser lowercase trap (fetch normalizes only six methods, not QUERY), CORS preflight costs (often no worse than the JSON POST being replaced), and infrastructure allowlists that silently drop unknown methods at the edge. Recommended adoption paths: use it now for server-to-server traffic, add it alongside POST for public APIs, and use the Content-Location GET handoff for browser-facing endpoints.