NewsPublished 22 Sep 2026

The Truth about GET and HTTP Standards, (Tue, Sep 22nd)

Source SANS ISC Handlers Diary

Description

On Friday, Xavier talked about the newly introduced HTTP Query method. This new method was introduced to allow "GET" requests that include a body. The main reason for this was that GET requests typically do not contain a body. But what if they do?

Impact

There is no direct security vulnerability or exploit described. The impact is primarily related to differing server behaviors when processing GET requests with bodies, which could affect application logic or interoperability but does not inherently represent a security threat or vulnerability.

Defensive guidance

No security mitigation is required as this is an informational discussion about HTTP method behavior. No vulnerabilities or exploits are reported, and no patches or configuration changes are necessary.

Summary

The HTTP Query method was introduced to permit GET requests to carry a body, which traditionally GET requests do not have. Testing on Apache 2.4.68 showed that it accepts and processes the body in a GET request, returning a 200 OK status. NGINX and Python's simple HTTP server respond with 200 OK but ignore the body content. This indicates variability in server implementations regarding GET requests with bodies, which may have implications for application behavior and HTTP standards compliance.

References

isc.sans.edu/diary/rss/33358 (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 22 Sep 2026, 15:02 UTC

References

Community reviews