Rack::MethodOverride only checks the X-Http-Method-Override header and the form encoded post body for _method. Rack::MethodOverrideWithParams checks both of those _and_ the query params. So, if you POST xml with a url like http://example.com/?_method=delete the application will see it as a delete request.