TL;DR. QUERY (RFC 10008) is a real HTTP method now, a GET that carries a body. I deployed echo endpoints on Vercel (Python and Node), Supabase Edge, and local FastAPI, then fired GET, POST and QUERY at each. Every runtime handled QUERY fine. Then Vercel's default bot mitigation started 403-challenging my QUERY traffic specifically. Same client, same body: 20 GETs clean, 20 POSTs clean, QUERY tripped the challenge on request #4. Reproduced from a second client. The functions are ready for QUERY. The edge in front of them is not.
RFC 10008 landed in June. If you missed the wave of explainers: QUERY is a request method with GET semantics (safe, idempotent, cacheable) that carries its query in the body instead of the URL. It closes the old gap where a search filter is too big for a query string but you don't want to lie and call it a POST.
Every post I read explained the spec. Nobody actually fired it at a live production edge. So I did, late one night, with a throwaway lab. Most of it was boring. One result made me sit up and say "wait, what?" out loud. Repo at the bottom.
The setup
Four echo endpoints, each returns the method and body it saw:
