QUERY Is the New GET, and That's a Problem
The new safe+idempotent HTTP method that lets you ship SQL inside the request body was published with a Security Considerations section five paragraphs long. Five. So. RFC 10008. In June 2026, the IETF published RFC 10008 — The HTTP QUERY Method. It defines a new HTTP verb that sits in the gap nobody realized was embarrassing the protocol for thirty years: the gap between GET (safe, idempotent, cacheable, no body, URI-logged) and POST (has a body, not safe, not idempotent, not automatically cacheable, looks dangerous). ...