Back to feed
Dev.to
Dev.to
7/7/2026
Testing HTTP QUERY (RFC 10008) against real infrastructure: managed CDNs reject it, open proxies forward it

Testing HTTP QUERY (RFC 10008) against real infrastructure: managed CDNs reject it, open proxies forward it

Original: I sent HTTP QUERY through the real internet. The smarter the layer, the harder it broke.

Short summary

The author tested the new HTTP QUERY method (RFC 10008) against ten production CDN edges, three browser engines, and real client libraries, finding that 'smarter' managed platforms like CloudFront and Akamai reject the method while 'dumb pipe' proxies like nginx and HAProxy forward it fine. The deeper pattern: every layer with a hardcoded allow-list of HTTP methods frozen before June 2026 silently breaks QUERY. Forcing Varnish to cache QUERY also produced cache poisoning—serving one query's response to a completely different query.

  • •Managed CDNs (CloudFront, Akamai, Vercel) reject HTTP QUERY; open proxies (nginx, HAProxy, Fastly) forward it
  • •Every layer with a frozen method allow-list breaks QUERY — browsers, retry libraries, OpenTelemetry, OpenAPI, OWASP CRS
  • •Forcing Varnish to cache QUERY causes cache poisoning: different queries get the first query's cached response

Generated with AI, which can make mistakes.

Read full article at Dev.to

Is this a good recommendation for you?

Comments

Failed to load comments. Please try again.

Explore more

RFC 10008 Standardizes HTTP QUERY Method — Infrastructure Adoption Challenges Ahead
Dev.to
HTTP Just Got Its First New Method in 20 Years. Here's Why You Should Care.
Dev.to
The user wants me to rewrite a headline about HTTP getting a new request method called QUERY.
Dev.to
HTTP finally has a proper way to send a query: meet the QUERY method
Dev.to