For sixteen years, developers who needed to ask complex questions of a server have been stuck with a workaround. When a

For sixteen years, developers who needed to ask complex questions of a server have been stuck with a workaround. When a search payload grew too large for a URL, or when nested filters and sensitive parameters refused to fit inside a query string, the only practical option was POST. It carried the bytes, but it lied about the intent. POST signals a change of state. Using it for a read-only operation forced the entire network path—caches, proxies, and browsers—to treat an innocent lookup as if it might alter a database.

That compromise has finally ended. In June 2026, the IETF published RFC 10008, formally standardizing the QUERY method. It is the first new HTTP method since PATCH was introduced in 2010. QUERY exists specifically for safe, idempotent requests that happen to need a body. It does not change server state. Repeating the same request produces the same result. It is cacheable, which means intermediaries can store and reuse the response. And unlike GET, it allows a data payload just like POST.

GraphQL queries and complex REST search endpoints are the clearest winners. You no longer have to jam sixty query parameters into a URL or hide a JSON filter document inside a POST body that intermediaries will refuse to cache. The semantics are now honest.

But an RFC is only ink. Between your application and your users sits a thick layer of infrastructure, and most of it has never heard of QUERY.

The caching problem is not solved yet

With a GET request, caching is straightforward. The cache key is the URI. Two users hitting the same URL get the same stored response, assuming headers permit it.

QUERY breaks that model because the request parameters live in the body. For a cache to recognize that two requests are identical, the cache key must incorporate both the URI and the body content. That requirement introduces real operational friction.

First, edge servers and CDNs must buffer the entire request body before they can compute a hash. That takes memory and time at the edge node. Second, two logically identical queries may not produce the same bytes. One client might send {"status":"active"} while another sends {"status": "active"} with different whitespace or key ordering. Unless the caching layer parses, normalizes, and canonicalizes the body—sorting JSON keys, stripping insignificant formatting, and handling encoding differences—the same question will miss the cache every time.

Most critically, mainstream CDNs do not yet partition cache by request body for QUERY. Cloudflare, for example, does not treat the body as part of the cache key for this method in its current form. If you deploy QUERY assuming that cacheable means cached, you may see collision errors, universal cache misses, or responses that leak across unrelated requests. Until your provider publishes explicit support, assume QUERY is not meaningfully cacheable in production.

Your tools will probably block it first

Every HTTP request traverses a stack of middleboxes, and most of them enforce hard rules about which methods are legal.

Web Application Firewalls and API gateways often rely on explicit allowlists. A typical ruleset permits GET, POST, PUT, DELETE, and PATCH. Anything else is dropped or answered with a 405 Method Not Allowed. QUERY will hit those walls before it ever reaches your application code.

Security rule engines add another obstacle. Some intrusion detection systems assume that a request carrying a body