Skip to main content
Mapagam

Configuring WebDAV

1. Enabling WebDAV Modules

Module Description Enabled by Default Notes
mod_dav Core WebDAV support module No Required for all WebDAV functionality
mod_dav_fs File system backend for WebDAV No Provides filesystem-based storage for WebDAV collections
mod_dav_lock Locking support for WebDAV No Enables locking mechanisms (e.g., for write operations)

Example: Enabling WebDAV Modules

<IfModule mod_dav.c>
    DAV on
</IfModule>

<IfModule mod_dav_fs.c>
    DAVLockDB /var/lib/dav/lockdb
</IfModule>
Note: Ensure that mod_dav and mod_dav_fs are loaded before using WebDAV features.

2. Setting Up DAV Directory

Directive Description Default Notes
DAV Enables WebDAV functionality for a directory Off Must be set to on or root
DAVLockDB Path to the lock database file /var/lock/apache2/dav.lock Required for locking support

Example: Basic DAV Directory Configuration

<Directory "/webdav">
    DAV on
    DAVLockDB /var/lock/apache2/dav.lock
    AuthType Basic
    AuthName "WebDAV Access"
    AuthUserFile /etc/apache2/webdav.passwd
    Require valid-user
</Directory>
Note: Ensure the mod_dav and mod_dav_fs modules are loaded for WebDAV support.

3. Configuring DAV Lock Database

Directive Values Description
DavLockDB /path/to/lockdb Specifies the path to the WebDAV lock database file.
DavLockDBType default, sqlite, mysql Defines the backend storage type for the lock database.
DavLockDBTimeout 3600 Lock timeout in seconds (default 1 hour).

Example: Setting up DAV Lock DB with SQLite

DavLockDBType sqlite
DavLockDB /var/lib/httpd/dav_lock.db
DavLockDBTimeout 7200
Note: Ensure the directory containing the lock database is writable by the Apache user.
Warning: Using a shared or networked filesystem for the lock database may cause performance issues.

4. Setting WebDAV Permissions

Directive Description Default Notes
Dav On Enables WebDAV support for the directory or file Off Must be set to On to enable WebDAV
DavLockDB Path to the lock database file /var/lib/dav/lockdb Required for locking support in WebDAV
DavMinLockTimeout Minimum lock timeout in seconds 3600 Prevents locks from expiring too quickly

Example: Basic WebDAV Permissions Configuration

<Directory "/webdav">
    Dav On
    AuthType Basic
    AuthName "WebDAV Access"
    AuthUserFile /etc/webdav/users
    Require valid-user
</Directory>
Note: Ensure that the WebDAV lock database directory has appropriate permissions to allow Apache to write to it.
Warning: Misconfigured WebDAV permissions can lead to unauthorized access or data corruption. Always test configurations in a development environment first.

5. Implementing Authentication for WebDAV

Directive Description Default Notes
AuthType Sets the authentication method for WebDAV None Must be set to Digest or Basic
AuthName Defines the realm name for authentication WebDAV Used in the authentication challenge
AuthUserFile Path to the file containing user credentials None Required for AuthType Digest or Basic
AuthGroupFile Path to the file containing group definitions None Optional, used for group-based access control
Require Defines access control rules for WebDAV all granted Can be valid-user, user, or group

Example: Basic WebDAV Authentication Setup

<Directory "/webdav">
    DAV On
    AuthType Basic
    AuthName "WebDAV Access"
    AuthUserFile /etc/apache2/webdav-users
    Require valid-user
</Directory>

Example: Digest Authentication for WebDAV

<Directory "/webdav">
    DAV On
    AuthType Digest
    AuthName "WebDAV Digest"
    AuthUserFile /etc/apache2/webdav-users
    Require valid-user
</Directory>
Note: The AuthUserFile must contain users in the format username:realm:password. For Digest authentication, the password should be hashed using htdigest.
Warning: Ensure that the AuthUserFile is not accessible via HTTP to prevent exposure of credentials.

Authentication Methods Summary

  • Basic Authentication: Sends credentials in base64-encoded format. Not secure over HTTP.
  • Digest Authentication: Sends a hash of the password, providing better security than Basic.

6. Configuring DAV Methods

Method Description Enabled by Default Notes
PROPFIND Retrieves properties of a resource Yes Required for WebDAV functionality
PROPPATCH Modifies properties of a resource No Must be explicitly enabled for property changes
MKCOL Creates a new collection (folder) No Requires DAV:write-content-in-bucket capability
COPY Copies a resource to another location No Enabled via DAV:write-content-in-bucket
MOVE Moves a resource to another location No Requires DAV:write-content-in-bucket capability
DELETE Deletes a resource or collection No Must be explicitly enabled for deletion
PUT Stores content at a specified URL No Enabled via DAV:write-content-in-bucket
LOCK Acquires a lock on a resource No Used for exclusive access control
UNLOCK Releases a lock on a resource No Required for unlocking resources

Example: Enabling DAV Methods

<Location /webdav>
    DAV on
    Options +Indexes
</Location>
Note: The DAV on directive enables all WebDAV methods by default. For granular control, use DAV on with specific method overrides.
Warning: Enabling WebDAV methods can pose security risks if not properly configured. Always restrict access using Allow and Deny directives.

7. Using DAV Filesystem Module

Directive Description Default Notes
DAV Enables WebDAV support for a directory or file off Must be set to on or root
DAVMinTimeout Minimum timeout for DAV operations 60 seconds Set to 0 for no timeout
DAVLockDB Path to the lock database file /var/lock/apache2/dav.lock Must be writable by the web server process

Example: Enabling DAV on a directory

<Directory "/var/www/webdav">
    DAV on
    AuthType Basic
    AuthName "WebDAV Access"
    AuthUserFile /etc/apache2/webdav.passwd
    Require valid-user
</Directory>
Note: The DAV filesystem module requires the mod_dav_fs module to be loaded.
Warning: Ensure proper permissions on the filesystem directory to prevent unauthorized access.

8. Setting Request Limits

Directive Values Description
LimitRequestBody bytes Limits the maximum allowed size of the request body in bytes. Default is unlimited.
LimitRequestFields number Limits the maximum number of request fields (headers) allowed. Default is 1000.
LimitRequestFieldSize bytes Limits the maximum allowed size of a single request field (header) in bytes. Default is 16KB.
LimitRequestLine bytes Limits the maximum allowed size of the request line in bytes. Default is 8KB.

Example: Limiting Request Body Size

<Directory "/var/www/webdav">
    LimitRequestBody 1048576
</Directory>
Note: These limits apply to all WebDAV requests and can be overridden per directory or location.

9. Configuring DAV Timeout Values

Directive Default Description
DAVTimeout 60 Timeout in seconds for DAV operations. NEW in Apache 2.4.56

Example: Setting DAV Timeout

<Location /webdav>
    DAV on
    DAVTimeout 120
</Location>

10. Testing WebDAV Access

Example: Basic WebDAV Propfind Request

curl -X PROPFIND -H "Depth: 1" -u user:pass http://example.com/webdav/
Method Description Notes
PROPFIND Retrieve properties of a resource or collection Use Depth: 1 to list contents of collections
PROPPATCH Set properties on a resource or collection Requires proper permissions to modify properties
MKCOL Create a new collection (folder) Must be supported by the server to create directories
PUT Upload a file to the server Requires write permissions on parent collection
DELETE Remove a resource or collection Must have delete permissions to remove files or folders
Note: Ensure that the WebDAV module is enabled in Apache with mod_dav and mod_dav_fs for local filesystem access.
Warning: WebDAV can expose sensitive files if not properly secured. Always restrict access using <Limit> directives or authentication.

11. Troubleshooting WebDAV Issues

Common WebDAV Troubleshooting Steps

  1. Verify that the mod_dav and mod_dav_fs modules are loaded.
  2. Check the WebDAV configuration directives in httpd.conf or .htaccess.
  3. Ensure that the directory permissions allow WebDAV operations (e.g., DAV on is set correctly).
  4. Review the server error logs for WebDAV-related errors (e.g., mod_dav internal errors or permission denials).
  5. Validate that the client is using a compatible WebDAV protocol version (e.g., WebDAV v1 vs. RFC 4918).
  6. Test with a simple WebDAV client or curl to isolate client-side issues.
  7. Confirm that the WebDAV root path is correctly mapped and accessible to the server.
Issue Possible Cause Solution
403 Forbidden Insufficient permissions or DAV on not set Ensure DAV on is enabled and directory permissions allow WebDAV access
405 Method Not Allowed WebDAV method not supported or misconfigured Verify that Allow directive includes WebDAV methods (e.g., PROPFIND, PUT)
500 Internal Server Error Module not loaded or misconfigured Check httpd.conf for missing or incorrect module directives
415 Unsupported Media Type Client sends unsupported content type Ensure client uses correct Content-Type (e.g., text/xml) for WebDAV requests
Note: Use curl -X PROPFIND -H "Depth: 0" http://example.com/webdav/ to test WebDAV endpoints.

Example: Testing WebDAV with curl

curl -X PROPFIND -H "Depth: 0" -H "Content-Type: text/xml" http://localhost/webdav/

12. Securing WebDAV Endpoints

Directive Description Default Notes
Dav Enables WebDAV support Off Must be set to on or extended
DavLockDB Path to the lock database file /var/lock/dav.lock Must be writable by the web server user
DavMinLockAge Minimum age (in seconds) of a lock before it can be refreshed 3600 Set to 0 to disable lock refresh

Example: Basic WebDAV Configuration with Authentication

<Location /webdav>
    Dav on
    AuthType Basic
    AuthName "WebDAV Access"
    AuthUserFile /etc/httpd/conf/webdav-users
    Require valid-user
</Location>
Note: Ensure that the DavLockDB path is not accessible via HTTP to prevent unauthorized lock manipulation.
Warning: WebDAV can expose sensitive files if not properly secured. Always restrict access with strong authentication and authorization.

Was this article helpful?

Related Cheat Sheets