The "Query" Method: A new HTTP verb  🔗 **Source:** [The "Query" Method: A new HTTP verb](https://shawnhooper.ca/2026/07/12/http-query-verb-rfc-10008/) > [!note]+ Document Notes > --- > tags: [http-query-method, rfc-10008, laravel, api-design, pii-protection, web-development] > author: Shawn Hooper > source: shawnhooper.ca > reference: https://shawnhooper.ca/2026/07/12/http-query-verb-rfc-10008/ > date created: 2026-07-12 12:42 > --- > # The "Query" Method: A new HTTP verb > ## 📝 Summary > - The IETF published RFC 10008 in June 2026, defining a new HTTP method called QUERY — described as combining GET and POST without their respective compromises. > - QUERY lets a client send a request body (like POST) while remaining a safe, idempotent read operation (like GET), which plain GET can't do since it has no body. > - The author's stated favorite benefit: sensitive/PII data can move out of the URL querystring and into the request body, reducing how much of it leaks into server access logs. > - Laravel 13.19 already ships support for the new method, per a linked Laravel News post; the RFC itself is linked directly to rfc-editor.org. > - Bottom line: a genuinely new, standards-track HTTP verb exists now for read requests that need a body — worth knowing about for any API or query-string-PII cleanup work. > ## 💬 Comments (0) > No comments. Keys spell out "http" on a blue background. Today I learned that there’s a new method, or “verb” coming to the HTTP protocol. The Internet Engineering Task Force (IETF) published RFC 10008 in June 2026, which adds what is best described as a mix of GET and POST without the compromises. The QUERY method will allow you to make a request from an HTTP server, but with content in the body of the request, which GET does not support. There are a ton of benefits to this verb, the one I’m probably the most happy about is being able to take items out of the URL querystring that could contain sensitive information or personally identifiable information (PII). This will reduce the amount of this data that gets leaked out through log files. You can read the IETF’s RFC here: <https://www.rfc-editor.org/info/rfc10008> If you’re a Laravel developer, release 13.19 of the framework includes support for the new method. Read “[HTTP Query Method Support in Laravel 13.19](https://laravel-news.com/laravel-13-19-0)” for more about that., The "Query" Method: A new HTTP verb, Shawn Hooper, 01kxbkkqmt101hpjh7f33gnygp. ## Links - [[Client-Side Processing Does Not Move the Server Trust Boundary]] — contrasts: moving query parameters into a request body reduces URL-log exposure but doesn't remove server-side handling obligations. - [[A Defense Experts Fail Is Not a Defense for Users]] — applies-in: safer transport defaults matter because callers routinely leak sensitive query parameters into histories and logs.