Pull Request Checklist

• Have you read How to write the perfect pull request?
• Have you read through the contributor guidelines?
• Have you referenced any issues you're fixing using commit message keywords?
• Have you added copyright headers to new files?
• Have you checked that both Scala and Java APIs are updated?
• Have you updated the documentation for both Scala and Java sections?
• Have you added tests for any changed functionality?

Fixes

N/A (new feature)

Purpose

Add first-class support for the HTTP QUERY method as defined in RFC 10008.

The QUERY method is a safe, idempotent request method that carries a request body — combining the safety semantics of GET with the body-carrying capability of POST. It was published as a Proposed Standard in 2025 and addresses the long-standing need for content-bearing safe requests (e.g., complex search queries that exceed URL length limits).

Background Context

RFC 10008 defines QUERY as:

• Safe — does not alter server state (like GET)
• Idempotent — multiple identical requests have the same effect
• Cacheable — responses can be cached (keyed by request body via Content-Location)
• Body-bearing — the request content defines the query

This makes QUERY exempt from CSRF checks (same as GET/HEAD/OPTIONS) and suitable for the routes compiler, SIRD router, and all existing HTTP method infrastructure.

Changes

Core Constants

• Added QUERY to HttpVerbs trait (Scala) and HttpVerbs interface (Java)
• Added ACCEPT_QUERY to HeaderNames trait (Scala) and HeaderNames interface (Java)

Routes Compiler

• Added "QUERY" to the httpVerb parser alternatives in RoutesFileParser.scala

SIRD Router

• Added QUERY extractor to RequestMethodExtractors trait

Java Routing DSL

• Added QUERY(String pathPattern) convenience method to RoutingDsl

CSRF Filter

• Added "QUERY" to CSRFConfig.SafeMethods set (code default)
• Added "QUERY" to reference.conf method whitelist

Pekko HTTP Server

• Registered QUERY as a custom method via ParserSettings.withCustomMethods so Pekko HTTP accepts the method without returning 501

Binary Compatibility

• Added MiMa exclusion filters for the new trait members (ReversedMissingMethodProblem)

Documentation

• Updated HTTP method lists in ScalaRouting.md, JavaRouting.md
• Updated SIRD extractor docs in ScalaSirdRouter.md
• Updated Java Routing DSL docs in JavaRoutingDsl.md
• Updated CSRF safe method docs in ScalaCsrf.md, JavaCsrf.md

Tests

• Routes compiler parser test
• SIRD router test (RouterSpec)
• CSRF filter test (CSRFFilterSpec)
• Java Routing DSL test (AbstractRoutingDslTest)
• Scripted integration test (routes-compiler-routes-compilation-java)

Upstream Dependencies

Play WS (merged)

Play WS standalone has an open PR for QUERY method support in playframework/play-ws#1366. This adds query[T: BodyWritable](body: T) to the Scala API and query(BodyWritable body) to the Java API. No upstream AHC changes were required — execute("QUERY") preserves the request body for custom method strings.

Pekko HTTP (merged, not yet released)

Apache Pekko HTTP has merged built-in QUERY method support in apache/pekko-http#1077, adding HttpMethods.QUERY as a recognized constant. This landed on main after v2.0.0-M1 and is not yet in a published artifact. Once released, the withCustomMethods workaround in PekkoHttpServer.scala can be removed in favor of the built-in constant.

References

• RFC 10008 — HTTP QUERY Method
• playframework/play-ws#1366
• apache/pekko-http#1077