Read X-Method-Override header before X-HTTP-Method-Override

runtime/mux.go

@@ -320,7 +320,12 @@ func (s *ServeMux) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		path = r.URL.RawPath
 	}
 
-	if override := r.Header.Get("X-HTTP-Method-Override"); override != "" && s.isPathLengthFallback(r) {
+	override := r.Header.Get("X-Method-Override")
+	if override == "" {
+		override = r.Header.Get("X-HTTP-Method-Override")
+	}
+
+	if override != "" && s.isPathLengthFallback(r) {
 		r.Method = strings.ToUpper(override)
 		if err := r.ParseForm(); err != nil {
 			_, outboundMarshaler := MarshalerForRequest(s, r)
@@ -428,7 +433,8 @@ func (s *ServeMux) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 				continue
 			}
 
-			// X-HTTP-Method-Override is optional. Always allow fallback to POST.
+			// X-Method-Override or X-HTTP-Method-Override is optional.
+			// Always allow fallback to POST.
 			// Also, only consider POST -> GET fallbacks, and avoid falling back to
 			// potentially dangerous operations like DELETE.
 			if s.isPathLengthFallback(r) && m == http.MethodGet {

runtime/mux_test.go

@@ -206,6 +206,28 @@ func TestMuxServeHTTP(t *testing.T) {
 			respStatus:  http.StatusOK,
 			respContent: "GET /foo",
 		},
+		{
+			patterns: []stubPattern{
+				{
+					method: "GET",
+					ops:    []int{int(utilities.OpLitPush), 0},
+					pool:   []string{"foo"},
+				},
+				{
+					method: "POST",
+					ops:    []int{int(utilities.OpLitPush), 0},
+					pool:   []string{"foo"},
+				},
+			},
+			reqMethod: "POST",
+			reqPath:   "/foo",
+			headers: map[string]string{
+				"Content-Type":           "application/x-www-form-urlencoded",
+				"X-Method-Override": "GET",
+			},
+			respStatus:  http.StatusOK,
+			respContent: "GET /foo",
+		},
 		{
 			patterns: []stubPattern{
 				{