nginx silently rejects the new HTTP QUERY method

The RFC 10008 standard, approved in June, introduces a new HTTP method called QUERY. This method, like GET, is safe and idempotent but differs in that it carries a body, similar to POST. Although it appears to be a simple addition, the RFC notes that certain proxies, frameworks, and load balancer configurations might not recognize the QUERY method yet.

The exact consequences of this are unclear, as the RFC does not specify whether the method would result in a 404 or 405 error, or if it would simply ignore the body and treat it as a GET request. This ambiguity led to a practical investigation using a rented server and several different reverse proxies, including nginx, Caddy, and Traefik.

The server used was a FastAPI backend on port 8001, with three reverse proxies in front of it, a separate Django app, and a test droplet. The investigation revealed that curl, a popular command-line tool, sends the specified method through the -X flag and carries the body with it, regardless of the method. FastAPI, when configured with the QUERY method, echoed back the received method and body.

However, this did not work for Django, which checks the request method against a hardcoded list of HTTP methods. Modifying Django to recognize QUERY resulted in a successful 200 response, but the same method did not work with nginx. When using a plain proxy_pass configuration, the QUERY method was successfully passed to the backend.

However, adding a limit_except directive that excluded QUERY from the allowed methods resulted in a 405 Method Not Allowed error, even though the method was explicitly included in the route definition. This demonstrates that the QUERY method's acceptance depends on each layer of the application stack, from the client (curl) to the reverse proxies and finally to the backend framework.

The lack of clear guidance in the RFC and potential discrepancies in the handling of QUERY by different components make its implementation a complex task.