Cybersecurity Specialist: 2026-09-21

1. HTTP QUERY Method: The Grey Zone Between GET And POST

   SANS Internet Storm Center, 2026-09-18. Read, 4 min.

   Xavier Mertens writes for the SANS Internet Storm Center that RFC 10008, published by the IETF in June 2026, defines a new HTTP method called QUERY that carries the query in the request body instead of the URL, is safe, idempotent and explicitly cacheable, and is the first new standard HTTP verb since PATCH in 2010. He reports that handling is inconsistent in the wild, with nginx's limit_except pattern and Django's View class rejecting QUERY while curl, FastAPI's explicit routes, Caddy and Traefik pass it through, so controls written in terms of GET, POST, PUT, DELETE and PATCH each now have to make a deliberate decision about the new verb.

   Why it matters for this role: Any control you maintain that enumerates HTTP methods now has a verb it does not know about. Walk the proxy, firewall and application rules that list GET, POST, PUT, DELETE and PATCH and make a deliberate decision about QUERY rather than leaving whatever the default turns out to be.

Cybersecurity Specialist