A secure Apache WebDAV share needs more than Dav On: load both DAV modules, create a writable lock database outside the content tree, grant the Apache worker account controlled access to the repository, and require authentication before permitting file operations. The configuration below uses Apache’s filesystem provider and shows where method-level authorization and XML request limits fit.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What Apache WebDAV does
WebDAV extends HTTP so clients can work with remote files as resources. Depending on the client and authorization policy, users may list collections, download files, upload new files, replace existing files, create directories, copy or move resources, and delete them. That makes a DAV endpoint a write surface, not merely a web directory listing.
As an Amazon Associate I earn from qualifying purchases.
Apache implements this in two layers:
mod_davsupplies the WebDAV request methods and protocol handling.mod_dav_fssupplies the filesystem-backed provider that maps DAV resources to files and directories.
When the filesystem provider is selected, Dav On is an alias for the default filesystem provider. Enabling DAV on a URL does not itself create a repository, set file ownership, create a lock database, or authenticate users; those are separate configuration tasks.
Prerequisites and design decisions
Apache modules
Load or compile mod_dav and mod_dav_fs before enabling DAV. Module-loading syntax and package names differ by operating system, so use the module mechanism supplied by your Apache distribution. If either module is absent, Apache will reject the configuration or fail to provide the filesystem provider.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
A repository directory
Choose a directory dedicated to the share, such as /srv/webdav. Do not point DAV at an arbitrary system directory. A dedicated path makes ownership, backups, quotas, and auditing easier to reason about.
A lock-database directory
WebDAV locking requires a server-side lock database. Put it in a separate directory outside the repository and outside the publicly served content tree. The directory, not just the database filename, must be writable by Apache’s configured User and Group. Apache recommends a dedicated directory for this purpose.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
An authentication and authorization policy
Every DAV-enabled location should be protected by authentication. Apache’s documented guidance is to use Digest Authentication, or to use Basic Authentication only through an SSL/TLS-protected connection. Sending Basic credentials over an unencrypted connection exposes them to anyone able to observe the traffic.
Decide separately who may read and discover resources and who may change them. A common policy lets authenticated users perform read or discovery operations while reserving write-capable methods for an administrator or a smaller group.
How Apache maps a URL to the filesystem
You can enable DAV in a Directory, Location, or an Alias plus Directory arrangement. The right choice depends on how the URL is mapped:
| Mapping | Use it when | Important detail |
|---|---|---|
Alias + Directory |
A URL such as /webdav should expose a filesystem path outside the normal document root. |
Put Dav On, authentication, and filesystem authorization in the matching Directory block. |
Directory |
The DAV content is already under a path Apache serves directly. | Enable DAV only in that directory scope; do not turn it on globally unless every served directory is intended to be a DAV repository. |
Location |
The policy is primarily tied to a URL space and may need to cover a proxied or otherwise specially mapped endpoint. | Ensure the URL-to-storage mapping and filesystem permissions still point to the intended repository. |
These containers are alternatives for expressing scope, not three blocks that must all be added. Keep the DAV and authentication directives on the same effective URL scope so a later, broader rule cannot accidentally expose the repository.
Recommended Free Tools
Step 1: Create the repository and lock paths
Create the repository and a separate directory for the lock database using the operating system’s normal administrative tools. For the example below:
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
/srv/webdav # repository content
/usr/local/apache2/var # dedicated Apache state directory
/usr/local/apache2/var/DavLock # lock database base pathThe DavLockDB value is a base path. Do not append the database extension; Apache creates the database files it needs. The parent directory must already exist and be writable by the Apache worker account.
Keep the lock database outside the repository. If it sits inside the content tree, a client could potentially see or modify server state, and a backup or cleanup job could treat lock files as ordinary content.
Step 2: Set ownership and permissions deliberately
The Apache worker account must be able to traverse the repository directories, read existing resources, create and modify files, and remove or rename resources allowed by your policy. Grant only the access required for that account; do not make the repository world-writable just to get uploads working.
Free tools Windows power users keep installed
One-click scans. No signup required.
Files created through DAV are owned by Apache’s configured User and Group. Account for that in maintenance procedures. If an FTP account, deployment script, shell user, or synchronization process changes files behind Apache’s back, it can bypass the assumptions made by the DAV locking model and produce confusing ownership or stale-lock problems.
- Use a dedicated group or service account arrangement where possible.
- Verify directory execute permission as well as file read and write permission.
- Keep unrelated users from editing the repository directly unless that access is intentional and coordinated.
- Back up repository data and lock state according to your operational policy; do not place lock files in a location routinely deleted by temporary-file cleanup.
Permissions alone do not authorize a DAV request. Apache still evaluates authentication and authorization rules before allowing methods such as upload, move, copy, or delete.
Step 3: Configure the filesystem provider and lock database
The following is a minimal configuration shape. It uses an alias so /webdav maps to /srv/webdav, then applies DAV and authentication to that filesystem directory:
DavLockDB "/usr/local/apache2/var/DavLock"
Alias "/webdav" "/srv/webdav"
<Directory "/srv/webdav">
Dav On
AuthType Digest
AuthName "WebDAV"
AuthDigestProvider file
AuthUserFile "/etc/apache2/webdav.passwd"
<RequireAny>
Require method GET OPTIONS
Require valid-user
</RequireAny>
</Directory>This illustrates the required relationships, not a drop-in deployment for every operating system. The module-loading directives, password-file location, Apache service account, virtual-host layout, and TLS settings vary by package and platform.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsRank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
The lock database directive is normally global or placed in the relevant virtual host. If separate virtual hosts use separate repositories, decide whether they should share one lock database or use distinct paths. Whatever topology you choose, each path must be writable by the worker account and protected from ordinary web access.
Step 4: Require authentication on the DAV location
Do not leave a DAV-enabled location anonymous. Apache states the rule plainly: “Any location on the server where DAV is enabled should be protected by authentication.” An unauthenticated endpoint can permit remote users to alter content if write methods are available, and even read-only access may disclose filenames or data.
Digest Authentication
The example uses AuthType Digest with a file-based provider. The password-file directive and file-generation procedure depend on the Apache package you installed. Make sure the file is readable by Apache but not downloadable through the web server.
Basic Authentication over TLS
Basic Authentication can be used when the entire connection is protected by SSL/TLS. The TLS configuration is outside the DAV provider itself; configure the certificate, virtual host, and HTTP-to-HTTPS policy for your environment before allowing credentials or file content to travel over the endpoint. Basic Authentication without transport protection is not an acceptable substitute for Digest or TLS.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Authentication is not the same as write authorization
Require valid-user answers “is this caller authenticated?” It does not decide whether that caller may delete, move, or overwrite a resource. Add method-level authorization when different users need different capabilities.
Step 5: Restrict write-capable methods
WebDAV clients use more than GET. Discovery commonly involves OPTIONS and property requests; write workflows can use methods such as PUT, DELETE, MKCOL, COPY, MOVE, LOCK, and UNLOCK. The exact sequence varies by client.
Apache’s documented authorization example permits selected methods under one policy and requires an authenticated administrator for other methods. Adapt that pattern to the users and client behavior you actually need. For example, the following shape requires authentication for the location, then gives a named administrator the methods outside the selected read/discovery set:
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
<Directory "/srv/webdav">
Dav On
AuthType Digest
AuthName "WebDAV"
AuthDigestProvider file
AuthUserFile "/etc/apache2/webdav.passwd"
Require valid-user
<LimitExcept GET POST OPTIONS>
Require user dav-admin
</LimitExcept>
</Directory>Treat this as an authorization pattern to adapt, not as a universal method list. Some clients need PROPFIND to browse a collection, and a policy that omits it may look like a broken directory listing even though authentication succeeds. Conversely, adding every method to the read set grants more capability than a read-only user needs. Test the methods your client sends and keep write methods limited to the intended accounts.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchDo not use a rule that accidentally makes GET or OPTIONS anonymous when the location is supposed to be private. Combine method rules with a location-wide authentication requirement and inspect Apache’s effective authorization configuration after changes.
Step 6: Add a request-size limit when XML bodies need control
WebDAV uses XML request bodies for operations such as property and locking requests. If you need to constrain those bodies, use LimitXMLRequestBody in the applicable Apache scope. Apache notes that the ordinary LimitRequestBody directive has no effect on DAV requests, so setting only that directive does not provide the control you expect.
Choose a limit that accommodates the metadata your clients legitimately send, then test discovery, locking, and property updates. A limit that is too small can cause clients to fail on otherwise valid operations; a limit that is too large weakens the protection you intended.
Complete configuration checklist
- Modules: confirm both
mod_davandmod_dav_fsare loaded. - Provider: enable
Dav Ononly on the intended repository scope. - Locking: define
DavLockDBwithout a database extension and place it in a dedicated directory. - Lock permissions: make the lock-directory parent writable by Apache’s configured
UserandGroup. - Repository permissions: allow the worker account to traverse, read, create, modify, rename, and remove only what policy permits.
- Authentication: protect every DAV-enabled URL with Digest Authentication or Basic Authentication carried through TLS.
- Authorization: separate read/discovery methods from write-capable methods and restrict the latter to intended users.
- XML limits: use
LimitXMLRequestBodyif DAV XML request sizes must be constrained. - Out-of-band access: prevent unrelated FTP, shell, deployment, or cleanup processes from changing the repository without coordination.
- Validation: test listing, download, upload, directory creation, rename, copy, delete, locking, and rejected unauthorized methods.
Troubleshoot the common failure modes
Apache will not start after adding Dav On
Check that both DAV modules are installed and loaded, and that the directive is in a context supported by your Apache build. A missing filesystem provider or a syntax error elsewhere in the virtual host can produce the same startup failure. Validate the configuration with your platform’s Apache configuration-test command before reloading the service.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clients can read files but cannot upload or change them
Check three independent layers: the client’s authenticated identity, the method authorization rule, and filesystem write permission for Apache’s worker account. A successful GET proves only that reading works. It does not prove that PUT, MKCOL, MOVE, or DELETE is authorized or that the operating system permits the operation.
The lock database reports permission errors
Verify the parent directory exists, is owned or writable by the Apache User and Group, and is not mounted read-only. Confirm that the path in DavLockDB omits the extension and points outside the repository. Do not solve this by making the entire filesystem or document tree writable.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
The repository shows unexpected ownership
That is expected for files created through DAV: Apache creates them with its configured service identity. Adjust the group and maintenance workflow rather than handing broad write access to unrelated accounts. If another process must edit the same files, coordinate permissions and locking deliberately.
A client authenticates but cannot browse the share
Inspect the methods the client sends. Many clients use PROPFIND for discovery, so a policy that permits only GET and OPTIONS can block listing even when downloads work. Add only the discovery methods required by the client, while leaving write methods restricted.
Changing LimitRequestBody did not affect a DAV request
Use LimitXMLRequestBody for DAV XML payloads. The ordinary request-body directive does not control DAV requests according to Apache’s module documentation.
Files changed outside Apache behave inconsistently
Look for FTP users, shell scripts, synchronization tools, or deployment jobs modifying the repository directly. Such changes can bypass DAV locks and produce stale locks, unexpected ownership, or client cache conflicts. Restrict those paths or make the external workflow aware of the DAV service.
Choosing a deployment topology
| Decision | Option | Trade-off |
|---|---|---|
| Storage provider | Filesystem provider through mod_dav_fs |
Simple, direct mapping to local files; Apache’s documentation establishes this path but does not prescribe it for every backend. |
| Credentials | Digest Authentication | Avoids sending a reusable Basic credential in clear text; requires compatible client and password-file setup. |
| Credentials | Basic Authentication over TLS | Broad client compatibility when TLS is correctly enforced; unsafe without transport protection. |
| URL mapping | Alias plus Directory |
Clear separation between public URL and a repository outside the document root. |
| URL mapping | Location or direct Directory scope |
Useful when policy follows an existing URL or virtual-host layout; review the resulting filesystem mapping carefully. |
| Repository layout | One shared repository | Simpler administration, but method and filesystem permissions must prevent users from reaching one another’s data. |
| Repository layout | Per-user repositories | Stronger separation, at the cost of more paths, credentials, backups, and lock-database administration. |
Apache’s module documentation establishes the filesystem-provider requirements and security principles, not one mandatory topology. Choose the arrangement that matches your identity model, isolation needs, and backup process.
Test the endpoint before handing it to users
- Reload Apache only after a successful configuration validation.
- Connect with an authenticated account and confirm the expected repository URL, such as
https://example.invalid/webdavin your own environment. - Verify that directory discovery works for the client methods your policy permits.
- Download an existing file, then test an upload with an account that should have write access.
- Test directory creation, rename, copy, move, delete, and lock operations separately; a policy can permit one while denying another.
- Repeat the write tests with a read-only account and confirm that unauthorized methods are rejected.
- Inspect ownership of a file created through DAV and verify that it matches the Apache service identity and your maintenance plan.
- Confirm the lock database remains outside the repository and that its directory survives service restarts and routine cleanup.
- Review logs for authentication failures, authorization denials, permission errors, and requests using methods you did not intend to expose.
What a secure minimum looks like
A defensible minimum is a filesystem repository mapped to a specific URL, mod_dav and mod_dav_fs loaded, Dav On enabled only for that repository, and a dedicated writable DavLockDB outside the content tree. Require authentication on the location, use Digest or Basic over TLS, and put write-capable methods behind an administrator or other explicitly authorized group. Finally, align operating-system ownership with Apache’s worker account and test the actual methods used by your clients.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
