HTTP QUERY: The First New Method in 25 Years and the End of the POST-for-Query Era

HTTP QUERY: The First New Method in 25 Years and the End of the POST-for-Query Era

It has been a quarter century since HTTP became the backbone of the web. Since then, web pages, APIs, microservices, and edge networks have completely changed. Yet the core HTTP methods stayed almost the same: GET, POST, PUT, DELETE. In June 2026, the IETF added a new member to that family: QUERY. Standardized in RFC 10008, this method technically fills the gap between GET's lack of a body and POST's wrong semantics for read-only operations. Practically, it legitimizes an architectural hack we have been using for years.

When developers needed to send complex search, filter, or query payloads in the request body, what did we do? We used POST. That was the reality in Elasticsearch queries, MongoDB find operations, and GraphQL endpoints. Even though we were semantically reading data, POST was the only body-bearing option available. In this article, we look at why QUERY took so long to arrive, what it changes, how it works, and what it means for CDNs.

Why GET Was Not Enough

GET is HTTP's most natural query method. It is safe, idempotent, and cacheable by default. But GET has one major limitation: all query parameters must fit in the URL. RFC 9110 recommends that HTTP implementations support URIs of at least 8000 octets. However, this is a recommendation, not a hard requirement. In practice, browsers, proxies, load balancers, and logging systems enforce much shorter limits.

Think of an e-commerce site with dozens of filters, an analytics dashboard with a complex JSON filter object, or a GraphQL query. Fitting this data into a URL is inefficient and risky. URLs get written to log files, stay in browser history, and become shareable. We do not want to send sensitive content as query parameters. Also, every different query combination appears as a distinct resource at the protocol level, which complicates cache management and resource modeling.

GET with a body is not technically forbidden. RFC 9110 says that a GET request body has "no defined semantics." You can send one, but proxies, caches, and servers may ignore it. This ambiguity makes GET-with-body unusable in production. A developer who needs to know whether the payload will survive the journey cannot rely on it.

These limits become especially visible in AI and data-intensive applications. As we emphasized in our enterprise local LLM deployment guide, every kilobyte and every extra request matters in modern infrastructure. GET's URL limits do not make large queries impossible, but they do not make them reliable or scalable either.

Why POST Was the Wrong Choice

When GET fell short, developers naturally turned to POST. POST can carry a body, everyone knows that. But POST's semantics say: "this request might create a resource or change state." That assumption travels through every layer of infrastructure.

The first problem is caching. POST responses are not cached by default. Even when cacheable, they are usually only stored for future GET or HEAD requests. So CDNs cannot automatically cache search results for POST requests. The second problem is retry. POST is not idempotent. When a network interruption happens, the client must worry: "If I resend this request, will I accidentally create two records?" Automatic retry mechanisms are unsafe for POST.

The third and deepest problem is protocol-level ambiguity. We can document that an endpoint "only reads." But the HTTP layer does not know that. A load balancer cannot route to a read-only replica, monitoring tools cannot automatically separate reads from writes, and audit logs must interpret "this POST was actually a query." The POST-for-query pattern has worked for years, but it has always remained a workaround.

Another side effect is user experience. When you submit a search form via POST and then refresh the results page, the browser warns: "Do you want to resubmit the form?" That happens because the browser cannot know whether POST is idempotent. With QUERY, that warning disappears; a refresh is just a safe read operation.

What QUERY Changes

RFC 10008 defines QUERY as follows: "The QUERY method requests that the request target process the enclosed content in a safe and idempotent manner and then respond with the result of that processing." In plain terms, this means QUERY is a body-bearing GET.

QUERY has four core properties. Safe: the request does not expect significant state changes on the target resource. Idempotent: sending the same request once or five times yields the same result. Cacheable: intermediaries and CDNs can store responses. Body-bearing: the query content travels in the request body, so URL length limits no longer apply.

The RFC's authors are also notable. RFC 10008 lists Julian Reschke (greenbytes), James M. Snell (Cloudflare), and Mike Bishop (Akamai) among its authors. These include both CDN veterans and some of the most experienced names in HTTP. That signals QUERY is not just a paper novelty; infrastructure providers are already invested.

Reschke has long contributed to specifications around HTTP extensions and WebDAV. Snell works on HTTP and edge technologies at Cloudflare. Bishop, at Akamai, is a well-known figure in HTTP/2 and HTTP/3 development. Together, this trio shows that QUERY rests on solid theoretical and practical foundations.

A QUERY request might look like this:

QUERY /search HTTP/1.1
Host: api.example.com
Content-Type: application/json

{
  "filters": {
    "category": "electronics",
    "price_min": 100,
    "price_max": 500
  },
  "sort": "price_asc",
  "limit": 50
}

The server can respond with 200 OK and the results, or with 303 See Other pointing to a resource that holds the results. In the second case, the client can GET the URI from the Location header to retrieve the results. This is especially useful for CDNs because the results can be cached like a normal GET resource.

The RFC also defines the Accept-Query header. A server can use this header to advertise which query formats it accepts. For example, a response like Accept-Query: application/graphql, application/json tells the client which content types the server accepts for QUERY requests. This makes API discovery and client-server negotiation easier.

GET, POST, and QUERY Compared

The comparison below summarizes why the three methods were designed for different scenarios. You can see how QUERY combines the best aspects of GET and POST.

The comparison makes it clear that GET is semantically perfect but cannot carry a body, while POST can carry a body but is neither safe nor idempotent. QUERY sits exactly where those two fall short. Of course, this does not mean QUERY will replace every POST or GET. CREATE, UPDATE, and DELETE operations still belong to POST, PUT, PATCH, and DELETE. But for read-only queries, there is now a more correct option.

CDNs and Infrastructure Impact

Beyond being a standalone novelty, QUERY's biggest impact will likely be at the CDN layer. As noted in the Hacker News discussion, current caching engines build cache keys from URL plus headers. With QUERY, the cache key must also include the body. That is a technically difficult transition.

Using the body as a cache key has two main challenges. First, the body may need to be compared bit by bit. If users send slightly different bodies every time, perhaps with different whitespace, line endings, or parameter order, the cache hit rate drops. Second, for some media types (like form-encoded data) parameter order does not matter, while for others (like GraphQL queries) it does. Normalizing bodies inside cache engines is a sensitive operation that can introduce security vulnerabilities.

Still, these challenges are solvable. CDN providers can hash the body (for example with SHA-256) to build a cache key. The RFC also notes that semantically insignificant differences can be normalized when generating the cache key. The presence of James Snell at Cloudflare and Mike Bishop at Akamai suggests both giants are evaluating support early. Once Cloudflare, Fastly, and CloudFront begin caching QUERY responses, the cost and performance curve of search-heavy backend systems will shift.

Here, a theme we touched on in our Vercel Eve agent framework review becomes relevant: every new standard in web infrastructure first comes to life at the CDN and edge layer, before frameworks catch up. The same timeline is likely for QUERY.

We should not exaggerate the economic impact. QUERY is not a sudden cost revolution. But it does mean higher cache hit ratios, reduced origin load, and better uptime through automatic retry for high-query-volume systems. In the long run, it will be an important optimization for search engines, analytics dashboards, and AI-based query APIs.

Real-World Use Cases

One of the clearest beneficiaries of QUERY is GraphQL. Today, GraphQL sends both read and write operations through POST on a single endpoint. That is the price of GraphQL's flexibility. With QUERY standardized, the GraphQL Foundation has a clean path to move read operations to QUERY. The query language itself will not change; only the transport protocol becomes more correct.

Elasticsearch, OpenSearch, and similar search engines typically receive queries inside a JSON body. Today, these requests use POST. Moving them to QUERY would make their responses cacheable at the HTTP layer. MongoDB find operations, complex REST filtering endpoints, and SQL-over-HTTP queries also fall into QUERY's target area.

Consider a practical example. In a SaaS reporting dashboard, a user selects more than 20 filters and sorts results by several metrics. Sending this query via GET is nearly impossible. Sending it via POST means the server gets hit again every time the user reopens the same report. With QUERY, you can send a large body and the results can be cached by the CDN. When the user opens the same report multiple times, subsequent requests may be served from the edge.

In software development, the balance between performance and correctness constantly shifts. As we saw in our Kimi K2.7 Code analysis, a small protocol or architectural improvement can produce significant gains at scale. QUERY is exactly that kind of improvement: not a revolution by itself, but it removes a long-standing inefficiency.

How Fast Will Adoption Be?

Just because the RFC is published does not mean every API will switch to QUERY tomorrow. Adoption will move up the stack. The first move will likely come from curl, OpenSSL, and edge proxies. Once tools like curl support the new method, testing and integration become easier. Then Nginx, Apache, HAProxy, and later frameworks like Express, FastAPI, Django, and Spring will update.

The browser side will be slower. The fetch() API needs WHATWG work to support QUERY. Also, QUERY is not a CORS-safelisted method. This means cross-origin QUERY requests require a preflight OPTIONS request, which will slow direct frontend usage somewhat.

The CDN side is critical. Cloudflare and Akamai's presence in the spec is a strong signal that both companies are evaluating early support. Fastly, CloudFront, and others will likely follow due to market pressure and customer demand. Costs for search and query-heavy applications will drop, and latency may visibly decrease especially in scenarios with high edge cache hit rates.

In enterprise environments, the transition will be slower. Converting existing APIs, updating client libraries, and running test cycles take time. Most teams will first experiment with QUERY on new endpoints and later migrate existing POST-for-query endpoints. Backward compatibility may last for years.

Criticisms and Caveats

Like any new standard, QUERY has its critics. The most common concern is that body-based cache keys can be abused. An attacker could fill the cache by slightly altering the body of every request. Therefore, CDNs must be careful when normalizing query bodies and must enforce limits.

Another issue is canonicalization. In JSON, whitespace differences are meaningless, but in GraphQL queries, comments or aliases can lead to different results. Which differences should a cache engine ignore, and which should it respect? There is no universal answer; each application must decide based on its media type.

Too strict a canonicalization policy could cause different queries to collapse into the same cache key and return wrong results. Too loose a policy would reduce cache hit ratios. Finding this balance will require close cooperation between CDN providers and API developers.

Another point not to overlook is security. Even though QUERY is safe, the server may still execute expensive queries. A user could stress a database with a poorly designed QUERY body. Therefore, rate limiting, query timeout limits, and access controls still apply to QUERY.

Finally, it is worth repeating that QUERY will not replace GET. Simple queries still belong to GET. Queries that fit in the URL, are shareable, and can be bookmarked are still best served by GET. QUERY is a complement that steps in where GET is not enough.

Conclusion: Protocol Catches Up With Practice

HTTP QUERY is far more than a new method after 25 years. It solves a problem at the protocol level that developers have long handled by misusing POST. A method that is safe, idempotent, cacheable, and body-bearing will affect many systems, from Elasticsearch to GraphQL, from MongoDB to REST search endpoints.

The real transformation will come on the day CDNs begin caching QUERY responses. Support from Cloudflare, Akamai, Fastly, and CloudFront could change the cost and performance curve of search-heavy backends. This transition will not finish in a few weeks, but the direction is clear. For now, the best thing developers can do is read the RFC, note existing POST-for-query endpoints, and watch framework support.

When do you plan to start using QUERY? Do you have a roadmap for migrating your current POST-based search endpoints? Share your thoughts in the comments or on social media. For more system design, infrastructure, and AI content, follow the blog homepage.