[audit][standards] HTTP QUERY method (draft-ietf-httpbis-safe-method-w-body) absent from well-known method table

Severity: medium · Category: missing-feature
Location: src/proxy/hdrs/HdrToken.cc:113

What's wrong

The static well-known method list contains only CONNECT, DELETE, GET, POST, HEAD, OPTIONS, PURGE, PUT, TRACE and the ATS-proprietary PUSH; QUERY is absent both here and in the HTTP_METHOD_/HTTP_WKSIDX_ initialization in src/proxy/hdrs/HTTP.cc:147-178. A QUERY request is therefore treated as an unknown method: it is proxied, but HttpTransactHeaders::is_method_cacheable and the GET-centric checks (e.g. src/proxy/http/HttpTransact.cc:3183, 6327) mean QUERY responses are never cached, defeating the primary purpose of the method (a safe, cacheable GET-with-body), and per-method stats/ACL matching cannot reference it. As QUERY approaches RFC status and origins/CDNs adopt it, ATS as a caching proxy will silently degrade to pass-through for that traffic.

Evidence

src/proxy/hdrs/HdrToken.cc:113:
  "CONNECT", "DELETE", "GET", "POST", "HEAD", "OPTIONS", "PURGE", "PUT", "TRACE", "PUSH",
// src/proxy/hdrs/HTTP.cc:147-156 initializes only these ten methods (no QUERY).

Suggested fix

Add QUERY to the hdrtoken static method tables and HTTP_WKSIDX_* set, and design cache-key semantics (key must incorporate a digest of the request content per the draft) before enabling caching for it; at minimum register the token so stats, ACLs, and plugins can match it.

Filed from an automated multi-lens codebase audit. Full report: CODEBASE_AUDIT.md / audit-report.html on branch claude/codebase-audit-review-9nw7vz.

Start with src/proxy/hdrs/HdrToken.cc:113 and the HTTP_WKSIDX_* initialization in src/proxy/hdrs/HTTP.cc:147-178 to trace how well-known methods are registered. Then inspect the cacheability checks in src/proxy/http/HttpTransact.cc:3183 and 6327, along with the draft's request-content cache-key requirements. Done should include a decided QUERY registration and cache-key behavior, with stats and ACL matching covered.