Understanding the New HTTP QUERY Method

The Emergence of HTTP QUERY The IETF has introduced the 'QUERY' method as a standardized way to request resources without the side effects associated with POST or the length limitations of GET. As this protocol evolves, security teams must recognize that any new HTTP verb creates potential blind spots in existing security infrastructure. While QUERY aims to improve efficiency in data retrieval, it may not be natively understood by all legacy Web Application Firewalls (WAFs) or intrusion detection systems, potentially leading to bypasses if not configured correctly. ## Securing Against Potential Abuse For security professionals, the goal is to ensure that your infrastructure is prepared for this shift. First, audit your WAF and API gateway configurations to ensure they are explicitly aware of the QUERY method. If your security solution does not recognize this verb, it might drop the request as invalid or, worse, pass it through without inspection. We recommend updating your security policy to treat QUERY requests with the same level of scrutiny as POST or PATCH methods, enforcing strict input validation and authorization checks for every incoming query to prevent injection attacks and unauthorized data access.

---

แหล่งที่มา: SANS Internet Storm Center เผยแพร่ครั้งแรก: Sat, 19 Sep 2026 04:51:46 GMT บทความต้นฉบับ: อ่านต้นฉบับ