Prompt and context
RFC 10008, published in June 2026, defines the HTTP QUERY method. It lets a client put the query description in request content while declaring a safe, idempotent operation on the target resource. The interview tests the gap between protocol semantics and infrastructure reality; it does not require an immediate migration of every existing POST search endpoint.
What interviewers assess
Interviewers want to see that QUERY is not “GET with a body” but an independent method: request content and media type participate in query semantics, cache keys must account for that content, and cross-origin calls generally require preflight. Strong answers also cover discovery with OPTIONS or Accept-Query, 405 fallback for unknown methods, gateway logs, and WAF compatibility.
Questions to clarify before answering
Is the query truly read-only?
Confirm that it does not change the target resource state. Safe and idempotent constrain target-resource semantics; a server can still create additional resources that carry results, so “no side effect” is not an absolute promise of no write anywhere.
What is the support envelope?
List browser Fetch, SDKs, reverse proxies, CDNs, WAFs, service meshes, and internal clients that must accept QUERY. A method can work at the application server while being rejected or rewritten in the middle.
What are the caching and privacy requirements?
Query content can contain sensitive filters. Identify which layers log the URI, request content, and cache key, then decide whether shared caching, redaction, or a POST path is appropriate.
30-second answer framework
“QUERY is useful when complex query content needs an explicit safe, idempotent, cacheable method. I would discover support through OPTIONS Allow or the Accept-Query response field, then verify real proxies, CDNs, WAFs, and clients in a compatibility matrix. The cache key must include request content and relevant media metadata, and cross-origin calls need preflight. If the ecosystem is not ready, I would keep GET for short queries and POST as a compatibility path rather than assuming infrastructure has upgraded because the RFC exists.”
Step-by-step deep answer
Step 1: Set the GET, QUERY, and POST boundary
Keep short, bookmarkable, copyable queries on GET. Evaluate QUERY for read-only operations with complex content. Keep POST when the operation changes state, the ecosystem lacks support, or existing form and client compatibility matters. Choose by semantics and deployment matrix together.
Step 2: Define content type and service contract
QUERY must carry a Content-Type consistent with its request content. The contract should specify the query format, pagination, sorting, errors, and whether results can be retrieved with GET through Content-Location or Location.
Step 3: Add capability discovery and safe fallback
Use OPTIONS Allow or Accept-Query to announce supported methods and query media types. If a client sees 405, 415, or gateway rejection, follow an explicit POST fallback policy; blind retries can amplify traffic.
Step 4: Design cache and retry behavior
QUERY is idempotent and can be retried after a connection failure, but the cache key must include request content and related metadata. Any normalization must preserve agreement between the cache and origin semantics, or one query can receive another query’s result.
Step 5: Verify cross-origin and operations
QUERY is not a CORS-safelisted method, so browsers trigger preflight. Verify OPTIONS, Allow, logs, metrics, WAF rules, rate limits, and tracing recognize the method, and record fallback rates and failure causes.
High-quality sample answer
I would not batch-replace POST because RFC 10008 was published. I would keep small, shareable filters on GET and trial QUERY only for read-only interfaces with large query content and a controlled client set. The server would require the correct Content-Type and advertise support with Accept-Query or OPTIONS; the cache key would include request content and media type, and cross-origin clients would pass preflight. Before launch, browsers, SDKs, gateways, CDNs, WAFs, and service meshes would run real queries while we watch 405, 415, cache mismatches, and log truncation. Any unsupported critical layer would keep the POST fallback until migration evidence is sufficient.
Common mistakes
- Mistake: Treating QUERY as GET with a body. → Why it fails: Method semantics, caching, and discovery rules differ. → Fix: Apply the RFC rules for content, safety, idempotency, and cache keys.
- Mistake: Testing only the application server. → Why it fails: Proxies, WAFs, CDNs, or SDKs may reject an unknown method. → Fix: Run a full-path compatibility matrix with a POST fallback.
- Mistake: Building a cache key from only the URI. → Why it fails: Different content can produce an incorrectly shared result. → Fix: Include request content and metadata, then test normalization.
- Mistake: Treating idempotency as permission to retry forever. → Why it fails: Retries still consume resources and amplify query load. → Fix: Combine timeouts, backoff, rate limits, and query-complexity limits.
Follow-ups and responses
Follow-up 1: Why not convert every complex query to QUERY?
Method semantics are only one condition. Clients, proxies, CDNs, WAFs, and monitoring must support the method together. When migration and fallback complexity exceed the value, mature POST remains safer.
Follow-up 2: Can QUERY responses be cached?
Yes, but the cache key must include request content and related metadata, and the cache must understand the media type. For sensitive results or risky normalization, restrict shared caching or expose an equivalent resource through GET.
Follow-up 3: What happens for a cross-origin browser call?
QUERY is not CORS-safelisted, so the browser sends a preflight. The server must answer OPTIONS and allow the method, requested headers, and origin; a failed preflight should become an explicit client error.
Follow-up 4: What if an unknown gateway returns 405?
Read Allow, choose the POST fallback from a versioned client policy, and record the cause and rate. Do not classify an unknown-method failure as a business query failure.