标签：#rfc10008

Introduction In June 2026, the IETF published RFC 10008 - the first new general-purpose HTTP method since PATCH was introduced in 2010. The method is called QUERY . In simple terms: QUERY = Safety of GET + Body of POST You can now send complex search/filter queries in the request body, while the server knows the operation is safe and idempotent . This means caching, automatic retries, and CDNs can all work properly. This single change can finally end the long-standing practice of using POST for search. The Problem We Had 1. Limitations of GET With GET, query parameters go in the URL: GET /products?category=electronics&price_min=1000&price_max=50000&brand=samsung,apple&sort=-rating&page=1&limit=20 When filters become complex (JSON filters, nested conditions, many tags), the URL easily exceeds 8,000 characters. Many servers, proxies, and browsers struggle with this. URLs also get logged, bookmarked, and shared — which is often undesirable. 2. Problems with POST So many developers started using POST for search: POST /products/search Content-Type: application/json { "filters": { "category": "electronics", "price": { "min": 1000, "max": 50000 }, "brands": ["samsung", "apple"] }, "sort": "-rating", "page": 1, "limit": 20 } But POST is not safe and not idempotent . That means: Caches and CDNs cannot safely cache the response Automatic retries after network failures are risky The server may treat it as a state-changing operation We have been pretending that a read operation is a write operation for years. What is the QUERY Method? According to RFC 10008: A QUERY requests that the request target process the enclosed content in a safe and idempotent manner and then respond with the result of that processing. In plain English: You send the query in the request body (like POST) The server processes it and returns the result It does not change any server state (like GET) Sending the same request multiple times produces the same result (idempotent) Comparison Table Property GET Q