# The QUERY HTTP Method Moves PII Out of Access Logs ## Claim The new QUERY HTTP method lets a safe, idempotent read request carry a body instead of a querystring, which keeps sensitive parameters out of the plaintext access logs that URL-based query strings routinely leak into. <!-- atomicity: 1 idea ✓ --> ## Scope & conditions - Applies to any read-style API request that currently either abuses POST (losing safety/idempotency semantics) or puts sensitive identifiers directly in the URL. - The privacy benefit only materializes once servers, proxies, and CDNs in the actual request path support and correctly log/cache QUERY — a framework supporting it (Laravel 13.19) is necessary but not sufficient for the full chain. - Standards-track (RFC 10008, June 2026) but early; broad ecosystem support isn't established yet. ## Evidence RFC 10008 defines QUERY as combining GET's safe, idempotent semantics with POST's ability to carry a request body. Laravel 13.19 already ships support. The practical benefit: PII or other sensitive identifiers that would previously sit in a URL querystring — and therefore land in server access logs by default — can move into the request body instead. ## Links - [[3. Resources/MOCs/WordPress Hosting Security Stack MOC]] — applies-in: reducing PII exposure in logs is a hosting/security-stack concern independent of any one framework's adoption ## Tests / falsifiers - Check whether major reverse proxies and CDNs (nginx, Cloudflare) log QUERY request bodies by default the way they do GET querystrings — if bodies get logged too, the privacy benefit doesn't materialize automatically. - Track adoption beyond Laravel over the next year; if no other major framework or platform picks it up, the practical impact stays narrow regardless of the RFC's standards-track status. ## Maintenance - Last tended: 2026-08-16 - Next review: 2026-11-16 ## Source - [[3. Resources/Literature Notes/The Query Method - A new HTTP verb]] — reports RFC 10008 and Laravel 13.19's implementation.