Description:
+ You may wish to add a <Limit>
clause inside the <Location>
directive to limit access to
+ DAV-enabled locations. If you want to set the maximum amount of
+ bytes that a DAV client can send at one request, you have to use
+ the LimitXMLRequestBody
+ directive. The "normal" LimitRequestBody
directive has no effect on DAV
+ requests.
+
+ Full Example
+ DavLockDB /tmp/DavLock
+
+ <Location /foo>
+
+ Dav On
+
+ AuthType Basic
+ AuthName DAV
+ AuthUserFile user.passwd
+
+ <LimitExcept GET HEAD OPTIONS>
+
+ require user admin
+
+ </LimitExcept>
+
+ </Location>
+
+
+ Security
+
The use of HTTP Basic Authentication is not recommended. You
+ should use at least HTTP Digest Authentication, which is provided by
+ the mod_auth_digest
module. Nearly all WebDAV clients
+ support this authentication method. Of course, Basic Authentication
+ over an SSL enabled connection is secure,
+ too.
+
+
Use the Dav
directive to enable the
- WebDAV HTTP methods for the given container. You may wish to add a
- <Limit>
clause
- inside the <location>
directive to limit access to
- DAV-enabled locations.
+ WebDAV HTTP methods for the given container:
-
Example
- DavLockDB /tmp/DavLock
-
- <Location /foo>
- Dav On
-
- AuthType Basic
- AuthName DAV
- AuthUserFile user.passwd
-
- <LimitExcept GET HEAD OPTIONS>
- require user admin
- </LimitExcept>
- </Location>
-
+
+ <Location /foo>
+
+ Dav On
+
+ </Location>
+
+
+
The value On
is actually an alias for the default
+ provider filesystem
which is served by the mod_dav_fs
module. Note, that once you have DAV enabled
+ for some location, it cannot be disabled for sublocations.
+ For a complete configuration example have a look at the section above.
+
+
+ Do not enable WebDAV until you have secured your server. Otherwise
+ everyone will be able to distribute files on your system.
+

Use the DavDepthInfinity
directive to
- allow the processing of PROPFIND requests containing the header
- 'Depth: Infinity'. Because this type of request could constitute a
- denial-of-service attack, by default it is not allowed.
-
-
Use the DavLockDB
directive to specify
- the full path to the lock database, excluding an extension. The
- default (file system) implementation of mod_dav uses a SDBM
- database to track user locks. The utility
- modules/dav/util/lockview
can be used from the server
- to display all locks in a lock database.
-
-
Example
-DavLockDB /tmp/DavLock
-
+ allow the processing of
PROPFIND
requests containing the
+ header 'Depth: Infinity'. Because this type of request could constitute
+ a denial-of-service attack, by default it is not allowed.
When a client requests a DAV resource lock, it can also
@@ -108,9 +130,11 @@ a DAV resource