IETF’s QUERY Method Reaches Proposed Standard While nginx Cache Support Lags

Overview

• The IETF published RFC 10008 to add QUERY as a new, GET-like method that is safe, idempotent and allowed to carry a request body with the body included in the cache key.
• Common clients and language libraries can already send QUERY requests with a body without special flags, so client-side tooling is largely ready for the new method.
• Some web frameworks block unknown methods by default and need small code changes to accept QUERY, for example adding 'query' to Django View.http_method_names.
• Operational tests show many proxies will pass QUERY through but that nginx has two major problems: limit_except can silently return 403 and nginx’s proxy_cache_methods accepts only GET, HEAD and POST and will reject attempts to mark QUERY cacheable.
• Teams should audit proxies, hardening snippets and caching layers before adopting QUERY because nginx evaluates cacheability using the client-sent method so method rewrites do not enable caching and deployment gaps could break or silently drop requests.