{
  "id": 167596,
  "title": "New HTTP QUERY Method (RFC 10008) Explained | Stop Using POST for Search",
  "url": "https://urgent.news/2026/08/05/new-http-query-method-rfc-10008-explained-stop-using-post-for-search",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-05T09:14:47.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/rakibulislamdev/new-http-query-method-rfc-10008-explained-stop-using-post-for-search-5356"
  },
  "original_language": "en",
  "account": "In June 2026, the Internet Engineering Task Force (IETF) introduced RFC 10008, marking the first new general-purpose HTTP method since PATCH in 2010. The new method, called QUERY, combines the safety and idempotent nature of GET with the ability to send complex data in the request body, like POST. This innovation allows for safer, more efficient handling of search, filtering, and report generation operations.\n\nThe issue with traditional GET and POST methods was their inability to handle complex queries effectively. GET struggled with long query strings and logging, while POST was misused for read operations and lacked safety and idempotency. This misuse resulted in caches and CDNs being unable to cache responses, automatic retries becoming risky, and servers treating read operations as write operations.\n\nThe QUERY method addresses these problems by allowing a server to process the enclosed content safely and idempotently, returning the result without changing server state. It can be used with different data formats such as JSON, SQL, or JSONPath, making it highly versatile. For instance, a QUERY method request can look like QUERY /products/search with a JSON body containing filters like status, price range, brands, sort options, and pagination data.\n\nWhen comparing QUERY to GET and POST, QUERY offers safety and idempotency while allowing request bodies, making it suitable for complex queries. In contrast, GET is limited by URL length and caching capabilities, while POST cannot be used for read operations safely.\n\nThe benefits of QUERY include proper semantics for read-only operations, improved caching and performance due to body inclusion in cache keys, safe retries in case of network failures, and better privacy and logging since complex queries are no longer visible in URLs. However, not all systems support QUERY yet, so thorough testing is necessary before production use. QUERY is not CORS safelisted, which might require a preflight request, and servers must handle the Content-Type correctly to avoid 400 or 415 errors.\n\nTo utilize QUERY, developers can modify their server-side code, such as in Node.js with the Express framework, to support the new method. A simple example involves listening for QUERY requests on a specific path, parsing the request body, and executing the search logic. The response typically includes a 200 OK status code along with the search results.\n\nThe QUERY method signifies a significant step forward in HTTP functionality, allowing APIs to use more appropriate methods for their respective operations and ultimately improving overall API design and performance.",
  "summary": "Introduction In June 2026, the IETF published RFC 10008 - the first new general-purpose HTTP method since PATCH was introduced in 2010. The method is called QUERY . In simple terms: QUERY = Safety of GET + Body of POST You can now send complex search/filter queries in the request body, while the server knows the operation is safe and idempotent . This means caching, automatic retries, and CDNs…",
  "key_points": [
    "RFC 10008 introduces QUERY method in June 2026, first new HTTP method since 2010.",
    "QUERY combines GET's safety/idempotency with POST's ability to send complex data in request body."
  ],
  "editors_take": null,
  "illustration": "https://urgent.news/ill/167596.png",
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}