NGINX can accept HTTP PUT requests in two fundamentally different ways: it can write the request body directly to disk through ngx_http_dav_module, or it can proxy the request to an application that owns validation, authorization, and storage. A 405 response usually means the request reached a location that does not permit the method, the DAV module is unavailable, an access rule rejected the request, or the upstream application declined it. Choose the ownership model first, then configure and test the matching path.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Choose who owns the PUT operation
The correct configuration depends on what the URL represents. A controlled file-drop endpoint can be handled by NGINX itself. A REST resource such as /api/items/42 normally belongs to an application, because the application must decide whether the caller may overwrite that resource, how the body is validated, and how conflicts are handled.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →| Question | Direct DAV upload | Proxy to an application |
|---|---|---|
| Who stores the body? | NGINX writes a file under the configured document root. | The upstream application or its storage layer. |
| Where are validation and authorization decided? | Primarily through NGINX access controls and filesystem permissions. | In the application, with NGINX providing the transport boundary. |
| Filesystem exposure | The worker account needs write access to the upload tree. | NGINX does not need to expose an upload tree to the client-facing location. |
| Resource semantics | Best for predictable file paths and controlled drops. | Supports application-specific validation, ETags, version-conflict checks, partial-update rules, and business workflows. |
| Main operational risk | A permitted client may overwrite or create files wherever the location maps. | A routing, authentication, or upstream policy error can reject the method or send it to the wrong service. |
Do not enable both designs in the same location accidentally. A location that is intended to proxy an API should not also expose a writable filesystem root, and a file-drop location should not silently forward arbitrary paths to an application.
Design 1: let NGINX write the uploaded file
Check that the DAV module exists
Direct PUT handling is provided by NGINX’s ngx_http_dav_module. The module processes PUT, DELETE, MKCOL, COPY, and MOVE, but it is not built by default. The NGINX build must include --with-http_dav_module.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
nginx -V 2>&1Inspect the configure arguments in the output for --with-http_dav_module. If it is absent, install or build an NGINX package that includes the module, or rebuild NGINX with that configure option before using dav_methods. A configuration test cannot make an absent module available.
Create a dedicated upload location
Keep writable content separate from ordinary web pages and application code. This example maps URLs under /uploads/ to the filesystem below /data/www and permits only PUT through DAV:
location /uploads/ {
root /data/www;
client_body_temp_path /data/client_temp;
dav_methods PUT;
create_full_put_path on;
dav_access user:rw group:rw all:r;
limit_except GET {
allow 192.168.1.0/32;
deny all;
}
}With root /data/www, a request for /uploads/photo.jpg maps beneath the configured root according to NGINX’s normal root processing. Verify the resulting path on a disposable test file before accepting production data. The temporary body directory, /data/client_temp, must also be usable by the NGINX worker account.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Understand the DAV directives
dav_methods PUT;enables only the DAV method needed for this endpoint. AddingDELETE,MKCOL,COPY, orMOVEexpands what a client can change and should be a deliberate decision.create_full_put_path on;allows NGINX to create missing intermediate directories for a PUT. The default isoff; without this setting, the parent directory structure must already exist.dav_access user:rw group:rw all:r;sets permissions for newly created files and directories. Match these permissions to the account and group that must later read, scan, back up, or process the files.client_body_temp_pathselects where NGINX stores request bodies temporarily while processing them. It is not a substitute for the final upload directory and must have suitable space and permissions.
Make filesystem permissions agree with NGINX
The worker process needs write and directory-traverse permission on the destination. If the worker cannot create a file or a missing parent directory, the request can fail even though the HTTP method is enabled. Check ownership, group membership, directory mode bits, available disk space, and any mandatory access-control policy used by the operating system. Grant write access only to the dedicated upload tree; do not make the entire web root writable.
Test a direct upload safely
Use a disposable filename and a client on the permitted network:
printf 'put testn' > /tmp/put-test.txt
curl -i -X PUT --data-binary @/tmp/put-test.txt http://your-host.example/uploads/put-test.txtConfirm the response status, inspect the NGINX access and error logs, and verify that the expected file was created with the intended owner and mode. Remove the test file after verification. A successful HTTP response is not enough: confirm the on-disk path and permissions as well.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Protect a writable DAV endpoint
Never treat dav_methods PUT as authorization. Anyone who can reach an unrestricted location could create or overwrite files allowed by the mapping. Add an authentication mechanism, a network allowlist, or both. Keep the location off the public Internet unless the threat model explicitly supports Internet-facing file writes. Enforce request-size limits and monitor disk usage at the surrounding server or location level. If clients need to replace existing files, decide whether that overwrite behavior is acceptable; DAV itself does not provide your application’s business-level conflict policy.
Design 2: proxy PUT to an application
Use a normal reverse-proxy location
For an API, let the upstream service parse and validate the body, authenticate the caller, authorize the target resource, and perform the write:
location /api/ {
proxy_pass http://backend;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}NGINX can proxy to another HTTP server or to an application built with a framework such as Python or PHP. proxy_pass is valid in a location block. In the ordinary configuration above, proxy_pass_request_body defaults to on and proxy_pass_request_headers also defaults to on, so the PUT body and request headers are sent upstream unless another part of the configuration changes those directives.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Verify the URI that reaches the upstream
The most common proxy mistake is an unintended path rewrite. The trailing URI in proxy_pass changes how NGINX maps the location prefix:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Configuration | Incoming request | Path sent upstream |
|---|---|---|
location /name/ { proxy_pass http://backend/remote/; } |
/name/item/42 |
/remote/item/42; the normalized /name/ prefix is replaced. |
location /api/ { proxy_pass http://backend; } |
/api/items/42 |
The original or full normalized request URI is forwarded according to NGINX’s documented processing rules. |
Choose the form your application expects, then test a representative resource such as /api/items/42. Log or otherwise inspect the upstream’s received method, path, headers, and body during testing. A PUT can reach the correct server yet still fail because it arrived at /remote/... when the application was written to expect /name/..., or because the body was disabled by an inherited directive.
Keep application responsibility explicit
- Validate the content type, schema, size, and fields in the application.
- Authorize the caller for the specific resource, not merely for the URL prefix.
- Define overwrite and conflict behavior, including any ETag or version checks.
- Return the API’s intended status code and error body instead of relying on a generic NGINX response.
- Store the body in the application’s chosen database, object store, or filesystem, with its own transaction and cleanup rules.
NGINX accepting and forwarding the method does not mean the upstream will accept it. Framework routing, CSRF policy, authentication middleware, content parsers, and application method allowlists can all reject PUT after the proxy has done its job.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Restrict methods and clients without creating a false sense of security
Understand limit_except
limit_except is valid in a location context and accepts PUT in its method list. A block such as limit_except GET { ... } limits access to every method except GET and HEAD; it is not a PUT-only switch. Consequently, the example’s allowlist applies to PUT, DELETE, POST, and other non-GET methods that might later be routed into the same location.
location /api/ {
proxy_pass http://backend;
limit_except GET {
allow 192.168.1.0/32;
deny all;
}
}If the location must support several public methods but protect only a particular operation, use separate, more specific locations or enforce the method policy in the application rather than assuming that one broad limit_except block expresses your complete authorization model.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Combine network controls with identity
Use allow/deny for network boundaries and add basic authentication, JWT authentication, or an equivalent access-control module when the caller’s identity matters. An IP allowlist identifies a network address, not a human or service account. On a proxied API, the application must still authorize the resource named in the PUT request. On a direct DAV endpoint, filesystem permissions determine what the NGINX worker can write, so both network and filesystem boundaries must be correct.
Why NGINX returns 405 for PUT
A 405 means the request was handled by a route that does not permit the method; it does not prove that NGINX lacks general PUT support. Work through the request path in order:
- Confirm the selected location. A different prefix or regular-expression location may win the location-selection process and produce a 405, serve a static resource, or proxy to another service. Add temporary diagnostic logging and test the exact URL, including its trailing slash.
- For direct uploads, check the module. Confirm
--with-http_dav_moduleappears innginx -V. Without the module, DAV directives cannot provide PUT file handling. - Check the destination path. Ensure the parent directories exist, or enable
create_full_put_path on;. Verify that the worker account can write both the temporary body directory and the final destination. - Check access controls. Review
allow/deny, authentication, TLS termination assumptions, and any inherited restrictions. A client outside the permitted network can be denied before the body is written or proxied. - For APIs, inspect proxy routing. Confirm the upstream is reachable, the URI mapping is intentional, and no inherited setting turns
proxy_pass_request_bodyorproxy_pass_request_headersoff. - Inspect the upstream method policy. If NGINX forwards the request but the application responds with 405, fix the application’s route, middleware, or authorization policy rather than adding DAV directives to the proxy location.
- Read both logs. Compare NGINX access and error logs with the upstream’s request log. The method, selected path, response status, and upstream status reveal whether the failure occurred at the edge or in the application.
- Retest with a disposable resource. Send a controlled PUT to a non-production filename or API object before enabling writes for real clients.
Production checklist
- Choose direct DAV only for a deliberately bounded file-drop use case; choose proxying when PUT represents a domain resource.
- Use a dedicated location and destination tree for direct uploads.
- Verify the DAV build flag before deploying DAV directives.
- Set directory ownership, group access, and newly created-file permissions intentionally.
- Decide whether missing directories should be created; remember that
create_full_put_pathis off by default. - Keep request-body storage and final storage on filesystems with monitored capacity.
- Test the exact URI mapping for proxied requests, including whether a trailing URI in
proxy_passreplaces the location prefix. - Leave request-body and header forwarding enabled unless the upstream contract explicitly requires otherwise.
- Apply authentication and authorization; method acceptance alone is not permission to overwrite data.
- Review whether a broad
limit_except GETblock unintentionally exposes other non-GET methods. - Capture NGINX and upstream logs for a known test request, then remove diagnostic changes that reveal sensitive data.
- Start with a disposable resource and a restricted client network before opening production write access.
Which configuration should you deploy?
Use direct DAV when the requirement is a simple, controlled file drop, the URL-to-file mapping is acceptable, and a narrowly trusted client set can be enforced. Use an application proxy when the PUT operation has domain meaning, requires per-resource authorization, needs validation or conflict detection, or should not grant a web-server worker direct write access to the application’s storage. In either design, a 405 is diagnosed by tracing the selected location, access controls, and final method owner—not by blindly adding another PUT directive.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
