For a very long time, whenever I needed to send a query to a server, I had only two real options: GET or POST. Both worked. Based on personal preference, some prefer to use the HTTP GET method and others prefer HTTP POST. Recently, while going through the newly published RFC 10008, I came across a new HTTP method called QUERY that finally fills this gap. In this post, I am going to walk through what it is, why we need it, and how it actually works.
The problem with GET and POST
The most common way to send a query is to encode everything into the URL query parameters and send a GET request.
GET /feed?q=foo&limit=10&sort=-published HTTP/1.1
Host: example.org
This is clean and works well for most use cases, until your system grows.
- URLs have practical size limits. HTTP itself doesn't define a maximum URI length, but every system our request goes through has its own limits. Browsers, servers, proxies, load balancers, and CDNs all impose their own limits. Based on the RFC, it's said to be 8 KB. If any of these underlying systems has a URI limit, our request can be rejected with
414 URI Too Long. - Encoding. When working with nested filters, arrays, JSON, or query parameters with spaces, quotes, or Unicode, it is more prone to data-handling issues and even a nightmare to debug and isolate a real production issue.
- Sensitive data exposure. URIs are far more likely to be logged in browser history or saved in bookmarks than the request body, so putting sensitive data there is risky.
- Caching issues. For a GET request, the cache uses the full URL as the label for each stored response. The cache only reuses a stored response if the URL matches exactly; it doesn't understand if the user sends the same query parameters in a different order. Because of this, there will be fewer cache hits and wasted cache storage.