HTTP QUERY Method: The Grey Zone Between GET And POST., (Fri, Sep 18th)

RFC 10008 standardizes the HTTP QUERY method, creating potential WAF inspection bypasses, cache poisoning, and CSRF gaps because most defenses don't recognize the new verb.

The IETF published RFC 10008 in June 2026 defining HTTP QUERY, the first new standard method since PATCH in 2010, behaving as a safe, idempotent, explicitly cacheable GET whose query lives in the request body. SANS handler Xavier Mertens warns that WAF rules, API-gateway allowlists, CSRF middleware, and caches built around the classic verb set may not inspect QUERY bodies, allowing SQL injection or XSS payloads to bypass inspection where POST would be blocked. Behavior in the wild is inconsistent: nginx's limit_except silently rejects QUERY and never caches it, while curl, Caddy, Traefik, FastAPI explicit routes, and .NET 10 pass or support it, and Cloudflare/Akamai co-authored the RFC. The author found no QUERY requests in his logs yet and recommends updating method-matching rules and allowlists to include QUERY.