HTTP Gets QUERY: Safe Requests With Bodies Arrive

The QUERY Method: A New Era for HTTP Reads

The introduction of the QUERY method in RFC 10008 represents a landmark evolution for HTTP, directly addressing a fundamental tension between the safety and idempotency of GET requests and the expressive power of POST requests with bodies. For years, developers have grappled with the limitations of GET, particularly for complex queries where parameters exceed URL length limits, are exposed in logs, or become difficult to manage. The QUERY method elegantly resolves this by enabling rich, structured request bodies while preserving the crucial safety, idempotency, and cacheability semantics traditionally associated with GET. This is a significant win for applications dealing with complex data retrieval, such as those utilizing GraphQL or Elasticsearch, which have resorted to POST as a workaround. The ability to cache these richer requests, provided the cache key incorporates the request content, is a major performance implication. Moreover, the explicit nature of QUERY simplifies debugging and ensures interoperability, avoiding the ambiguity and potential for silent failures that arise from attempting to use GET with a body.

However, the practical impact hinges on widespread adoption. While the IETF has standardized it, the article rightly notes that adoption will likely be measured in years, similar to PATCH. Developers will need to see robust support across frameworks, libraries, and infrastructure components like CDNs and proxies. The specification's advice to treat it as additive rather than a replacement is wise, but it still requires conscious effort from both client and server developers to implement and utilize it. The article hints at this by mentioning tooling support, but the journey from RFC to ubiquitous implementation is often lengthy and fraught with inertia. Organizations that heavily rely on efficient, cacheable data retrieval for complex queries stand to benefit the most immediately, but broader developer awareness and education will be critical for its success. The 'why not optional body in GET' debate highlighted by the article also underscores the importance of clear semantics in protocol design; having a dedicated method for this use case provides that clarity and avoids the pitfalls of informal extensions.

Key Points

• RFC 10008 introduces the new HTTP QUERY method, the first new standard verb since PATCH in 2010.
• QUERY allows requests to have a body while retaining the safe, idempotent, and cacheable semantics of GET.
• It addresses limitations of GET (URL length, logging) and POST (not safe/idempotent) for complex data retrieval.
• Responses using QUERY remain cacheable if the cache key includes request content.
• The method aims to provide a standards-based alternative to tunneling complex reads through POST (e.g., GraphQL, Elasticsearch).
• Adoption is expected to be gradual, measured in years, with tooling support emerging.

---

📖 Source: IETF Publishes RFC 10008, Adding the QUERY Method for Safe Requests With a Body