Analista de Seguridad: 2026-09-21

1. HTTP QUERY Method: The Grey Zone Between GET And POST

   SANS Internet Storm Center, 2026-09-18. Leer, 4 min.

   Xavier Mertens writes for the SANS Internet Storm Center that RFC 10008, published by the IETF in June 2026, defines a new HTTP method called QUERY that carries the query in the request body instead of the URL, is safe, idempotent and explicitly cacheable, and is the first new standard HTTP verb since PATCH in 2010. He reports that handling is inconsistent in the wild, with nginx's limit_except pattern and Django's View class rejecting QUERY while curl, FastAPI's explicit routes, Caddy and Traefik pass it through, so controls written in terms of GET, POST, PUT, DELETE and PATCH each now have to make a deliberate decision about the new verb.

   Por qué importa para este rol: Check whether the inspection rules you work from name the request method at all. A payload you would catch on POST can pass uninspected over QUERY if the signature was written before RFC 10008, which means a quiet alert queue is not by itself evidence that nothing arrived.

Analista de Seguridad