HTTP QUERY method
termweb devnetworkingsecurity
The HTTP method standardized in June 2026 (RFC 10008) for read-only queries that carry a request body: safe and idempotent like GET, body like POST, cacheable with the body in the cache key.
The first new HTTP method since PATCH in 2010, it exists because GET forces queries into the URL and POST-as-search hides its read-only nature from every cache and proxy in the path. Adoption is a per-layer audit: WAF method allowlists written before mid-2026 block or blind-pass it, CORS requires a preflight, HTML forms fall back to GET, and any cache must key on the full body or invite poisoning.
Also known as: QUERY method, HTTP QUERY, RFC 10008, Accept-Query