IETF RFC 10008 Introduces QUERY Method: SecOps Implications for WAFs and API Gateways

What happened

In June 2026, the IETF formalized RFC 10008, establishing 'QUERY' as a standard HTTP method. Acting as a hybrid between GET and POST, QUERY allows safe and idempotent data retrieval while carrying payloads inside the request body rather than the URI. Servers communicate supported formats using a new Accept-Query header, and responses are explicitly cacheable.

Impact

Because the new method sits in a grey zone, legacy web infrastructure components handle it inconsistently. Security tools and application logic built prior to the spec often default to rejecting, dropping, or completely un-inspecting QUERY requests.

• WAF Inspection Bypasses: Many Web Application Firewalls and signature-based rules (SQLi, XSS) inspect request bodies exclusively for POST or PUT methods, leaving QUERY bodies uninspected.
• Inconsistent Framework Handling: Testing shows varying native behaviors; some reverse proxies (like nginx) and frameworks (Django) reject or ignore it, while others (Caddy, Traefik, FastAPI) pass the method straight through to application logic.
• Cache Poisoning Risks: Because QUERY is cacheable by specification, intermediate caches that fail to factor the request body into cache keys risk serving malicious or unintended query responses to subsequent clients.

What to do

SecOps and sysadmins must immediately audit their perimeter controls, reverse proxies, API gateways, and WAF configurations to account for the QUERY method.

• Audit allowlists and method-checking logic across all load balancers, proxies, and application routing layers to explicitly handle or restrict QUERY.
• Update WAF rule sets and payload inspection engines to parse request bodies for QUERY methods identically to POST requests.
• Verify that reverse proxy caching implementations correctly key cache entries on the request body to prevent potential cache poisoning scenarios.
• Run validation tests by duplicating existing attack payloads across GET, POST, and QUERY methods to identify and remediate blind spots.