Support for the HTTP QUERY method (RFC 10008)

What steps will reproduce the problem?

Send a QUERY /books request with Content-Type: application/x-www-form-urlencoded and the filter parameters in the body, to an action routed via yii\web\UrlRule / yii\rest\UrlRule.

What is the expected result?

RFC 10008 (Proposed Standard, June 2026) defines QUERY as a safe, idempotent, cacheable method whose parameters travel in the request body. The framework should treat it as safe, the same way it treats GET and HEAD.

What do you get instead?

Routing and body parsing already work: Request::getMethod() passes any verb through, UrlRule::$verb matches arbitrary verbs, and getBodyParams() parses by Content-Type regardless of method. But everything that hardcodes the safe-method list treats QUERY as unsafe:

• yii\web\Request::$csrfTokenSafeMethods = ['GET', 'HEAD', 'OPTIONS'] (framework/web/Request.php:136), so a QUERY request requires a CSRF token. Configurable, but wrong by default.
• yii\filters\HttpCache::beforeAction() hardcodes $verb !== 'GET' && $verb !== 'HEAD' (framework/filters/HttpCache.php:124), so there is no ETag / 304 for QUERY, and it cannot be fixed by configuration, only by subclassing.
• yii\filters\Cors::$cors['Access-Control-Request-Method'] does not list QUERY (framework/filters/Cors.php:97).
• yii\rest\UrlRule::$patterns has no QUERY entry (framework/rest/UrlRule.php:120), it currently needs extraPatterns.

Suggested minimum: add QUERY to the safe-method defaults (csrfTokenSafeMethods, Cors), let HttpCache handle it, and consider a getIsQuery() accessor for symmetry with the other verbs.

For reference, Symfony added QUERY support in 7.4 (symfony/symfony#61173), and API Platform has an open PR (api-platform/core#8349).

Additional info

Q	A
Yii version	2.0.53 (master)
PHP version	any
Operating system	any