Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

What are the security ramifications that one should be aware of when considering using WebDAV? How does one go about securing it? What else should I know about it?

share|improve this question

2 Answers 2

up vote 4 down vote accepted

WebDav by its self doesn't have any security. It'll let anyone touch anything. It says in the standards docs that this should be handled in the web-server layer (or application, if that's providing the WebDAV service).

Authentication
WebDAV has no native auth service, so one needs to be put in front of it. Different webservers handle this differently, depending on what dav module you're using. Server-specific modules (mod_dav) will behave differently than those that are based out of app-servers like Tomcat). This is the normal HTTP auth stuff; basic, digest, SASL, Kerberos, etc.

HTTPS
Since the authentication won't be encrypted without it (unless you're doing IIS-based webdav and NTLM), and the files won't be transferred encrypted.

Local Auth
Depending on what's driving the WebDAV, pay attention to the actual OS user that drops the files. Sometimes the Dav server will impersonate the actual user, other times it's all one user dropping files and it's up to the application to keep users away from files they shouldn't have access to.

share|improve this answer

It's basically the same as securing HTTP where resources can be modified: implement HTTPS and require authentication (password or client certificates).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.