It sounds like GET with a body is just undefined behavior.
Why not just standardize it? It seems to be a better way than adding a new method.
Why not just standardize it? It seems to be a better way than adding a new method.
2) A plain separation between GET should only accept query string parameters and QUERY should only accept body parameters potentially reduces attack surface of attackers trying to mix and match the two to find potential order of precedence attacks.