docs/manual/mod/mod_dav.html.en - httpd - Git at Google

 <?xml version="1.0" encoding="ISO-8859-1"?>
 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
 <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head>
 <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type" />
 <meta content="noindex, nofollow" name="robots" />
 <!--
         XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
               This file is generated from xml source: DO NOT EDIT
         XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
       -->
 <title>mod_dav - Apache HTTP Server</title>
 <link href="../style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" />
 <link href="../style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" />
 <link href="../style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" />
 <link href="../images/favicon.ico" rel="shortcut icon" /><link href="http://httpd.apache.org/docs/current/mod/mod_dav.html" rel="canonical" /></head>
 <body>
 <div id="page-header">
 <p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/directives.html">Directives</a> | <a href="../faq/">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p>
 <p class="apache">Apache HTTP Server Version 2.0</p>
 <img alt="" src="../images/feather.gif" /></div>
 <div class="up"><a href="./"><img title="&lt;-" alt="&lt;-" src="../images/left.gif" /></a></div>
 <div id="path">
 <a href="http://www.apache.org/">Apache</a> &gt; <a href="http://httpd.apache.org/">HTTP Server</a> &gt; <a href="http://httpd.apache.org/docs/">Documentation</a> &gt; <a href="../">Version 2.0</a> &gt; <a href="./">Modules</a></div>
 <div id="page-content">
 <div class="retired"><h4>Please note</h4>
             <p>This document refers to the <strong>2.0</strong> version of Apache httpd, which <strong>is no longer maintained</strong>. Upgrade, and refer to the current version of httpd instead, documented at:</p>
         <ul><li><a href="http://httpd.apache.org/docs/current/">Current release version of Apache HTTP Server documentation</a></li></ul><p>You may follow <a href="http://httpd.apache.org/docs/current/mod/mod_dav.html">this link</a> to go to the current version of this document.</p></div><div id="preamble"><h1>Apache Module mod_dav</h1>
 <div class="toplang">
 <p><span>Available Languages: </span><a href="../en/mod/mod_dav.html" title="English">&nbsp;en&nbsp;</a> |
 <a href="../ja/mod/mod_dav.html" hreflang="ja" rel="alternate" title="Japanese">&nbsp;ja&nbsp;</a> |
 <a href="../ko/mod/mod_dav.html" hreflang="ko" rel="alternate" title="Korean">&nbsp;ko&nbsp;</a></p>
 </div>
 <table class="module"><tr><th><a href="module-dict.html#Description">Description:</a></th><td>Distributed Authoring and Versioning
 (<a href="http://www.webdav.org/">WebDAV</a>) functionality</td></tr>
 <tr><th><a href="module-dict.html#Status">Status:</a></th><td>Extension</td></tr>
 <tr><th><a href="module-dict.html#ModuleIdentifier">Module&#160;Identifier:</a></th><td>dav_module</td></tr>
 <tr><th><a href="module-dict.html#SourceFile">Source&#160;File:</a></th><td>mod_dav.c</td></tr></table>
 <h3>Summary</h3>

     <p>This module provides class 1 and class 2 <a href="http://www.webdav.org">WebDAV</a> ('Web-based Distributed
     Authoring and Versioning') functionality for Apache. This
     extension to the HTTP protocol allows creating, moving,
     copying, and deleting resources and collections on a remote web
     server.</p>
 </div>
 <div id="quickview"><h3 class="directives">Directives</h3>
 <ul id="toc">
 <li><img alt="" src="../images/down.gif" /> <a href="#dav">Dav</a></li>
 <li><img alt="" src="../images/down.gif" /> <a href="#davdepthinfinity">DavDepthInfinity</a></li>
 <li><img alt="" src="../images/down.gif" /> <a href="#davmintimeout">DavMinTimeout</a></li>
 </ul>
 <h3>Topics</h3>
 <ul id="topics">
 <li><img alt="" src="../images/down.gif" /> <a href="#example">Enabling WebDAV</a></li>
 <li><img alt="" src="../images/down.gif" /> <a href="#security">Security Issues</a></li>
 <li><img alt="" src="../images/down.gif" /> <a href="#complex">Complex Configurations</a></li>
 </ul><h3>See also</h3>
 <ul class="seealso">
 <li><code class="directive"><a href="../mod/mod_dav_fs.html#davlockdb">DavLockDB</a></code></li>
 <li><code class="directive"><a href="../mod/core.html#limitxmlrequestbody">LimitXMLRequestBody</a></code></li>
 <li><a href="http://www.webdav.org">WebDAV Resources</a></li>
 </ul></div>
 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 <div class="section">
 <h2><a name="example" id="example">Enabling WebDAV</a></h2>
     <p>To enable <code class="module"><a href="../mod/mod_dav.html">mod_dav</a></code>, add the following to a
     container in your <code>httpd.conf</code> file:</p>

     <div class="example"><p><code>Dav On</code></p></div>

     <p>This enables the DAV file system provider, which is implemented
     by the <code class="module"><a href="../mod/mod_dav_fs.html">mod_dav_fs</a></code> module. Therefore, that module
     must be compiled into the server or loaded at runtime using the
     <code class="directive"><a href="../mod/mod_so.html#loadmodule">LoadModule</a></code> directive.</p>

     <p>In addition, a location for the DAV lock database must be
     specified in the global section of your <code>httpd.conf</code>
     file using the <code class="directive"><a href="../mod/mod_dav_fs.html#davlockdb">DavLockDB</a></code>
     directive:</p>

     <div class="example"><p><code>
       DavLockDB /usr/local/apache2/var/DavLock
     </code></p></div>

     <p>The directory containing the lock database file must be
     writable by the <code class="directive"><a href="../mod/mpm_common.html#user">User</a></code>
     and <code class="directive"><a href="../mod/mpm_common.html#group">Group</a></code> under which
     Apache is running.</p>

     <p>You may wish to add a <code class="directive"><a href="../mod/core.html#limit">&lt;Limit&gt;</a></code> clause inside the <code class="directive"><a href="../mod/core.html#location">&lt;Location&gt;</a></code> directive to limit access to
     DAV-enabled locations. If you want to set the maximum amount of
     bytes that a DAV client can send at one request, you have to use
     the <code class="directive"><a href="../mod/core.html#limitxmlrequestbody">LimitXMLRequestBody</a></code>
     directive. The "normal" <code class="directive"><a href="../mod/core.html#limitrequestbody">LimitRequestBody</a></code> directive has no effect on DAV
     requests.</p>

     <div class="example"><h3>Full Example</h3><p><code>
       DavLockDB /usr/local/apache2/var/DavLock<br />
       <br />
        &lt;Location /foo&gt;<br />
        <span class="indent">
          Dav On<br />
          <br />
          AuthType Basic<br />
          AuthName DAV<br />
          AuthUserFile user.passwd<br />
          <br />
          &lt;LimitExcept GET OPTIONS&gt;<br />
          <span class="indent">
            require user admin<br />
          </span>
          &lt;/LimitExcept&gt;<br />
        </span>
        &lt;/Location&gt;<br />
     </code></p></div>

    <p><code class="module"><a href="../mod/mod_dav.html">mod_dav</a></code> is a descendent of Greg Stein's <a href="http://www.webdav.org/mod_dav/">mod_dav for Apache 1.3</a>.  More
    information about the module is available from that site.</p>
 </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 <div class="section">
 <h2><a name="security" id="security">Security Issues</a></h2>

     <p>Since DAV access methods allow remote clients to manipulate
     files on the server, you must take particular care to assure that
     your server is secure before enabling <code class="module"><a href="../mod/mod_dav.html">mod_dav</a></code>.</p>

     <p>Any location on the server where DAV is enabled should be
     protected by authentication.  The use of HTTP Basic Authentication
     is not recommended. You should use at least HTTP Digest
     Authentication, which is provided by the
     <code class="module"><a href="../mod/mod_auth_digest.html">mod_auth_digest</a></code> module. Nearly all WebDAV clients
     support this authentication method. An alternative is Basic
     Authentication over an <a href="../ssl/">SSL</a> enabled
     connection.</p>

     <p>In order for <code class="module"><a href="../mod/mod_dav.html">mod_dav</a></code> to manage files, it must
     be able to write to the directories and files under its control
     using the <code class="directive"><a href="../mod/mpm_common.html#user">User</a></code> and
     <code class="directive"><a href="../mod/mpm_common.html#group">Group</a></code> under which
     Apache is running.  New files created will also be owned by this
     <code class="directive"><a href="../mod/mpm_common.html#user">User</a></code> and <code class="directive"><a href="../mod/mpm_common.html#group">Group</a></code>.  For this reason, it is
     important to control access to this account.  The DAV repository
     is considered private to Apache; modifying files outside of Apache
     (for example using FTP or filesystem-level tools) should not be
     allowed.</p>

     <p><code class="module"><a href="../mod/mod_dav.html">mod_dav</a></code> may be subject to various kinds of
     denial-of-service attacks.  The <code class="directive"><a href="../mod/core.html#limitxmlrequestbody">LimitXMLRequestBody</a></code> directive can be
     used to limit the amount of memory consumed in parsing large DAV
     requests.  The <code class="directive"><a href="#davdepthinfinity">DavDepthInfinity</a></code> directive can be
     used to prevent <code>PROPFIND</code> requests on a very large
     repository from consuming large amounts of memory.  Another
     possible denial-of-service attack involves a client simply filling
     up all available disk space with many large files.  There is no
     direct way to prevent this in Apache, so you should avoid giving
     DAV access to untrusted users.</p>
 </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 <div class="section">
 <h2><a name="complex" id="complex">Complex Configurations</a></h2>

     <p>One common request is to use <code class="module"><a href="../mod/mod_dav.html">mod_dav</a></code> to
     manipulate dynamic files (PHP scripts, CGI scripts, etc).  This is
     difficult because a <code>GET</code> request will always run the
     script, rather than downloading its contents.  One way to avoid
     this is to map two different URLs to the content, one of which
     will run the script, and one of which will allow it to be
     downloaded and manipulated with DAV.</p>

 <div class="example"><p><code>
 Alias /phparea /home/gstein/php_files<br />
 Alias /php-source /home/gstein/php_files<br />
 &lt;Location /php-source&gt;
 <span class="indent">
     DAV On<br />
     ForceType text/plain<br />
 </span>
 &lt;/Location&gt;
 </code></p></div>

     <p>With this setup, <code>http://example.com/phparea</code> can be
     used to access the output of the PHP scripts, and
     <code>http://example.com/php-source</code> can be used with a DAV
     client to manipulate them.</p>
 </div>
 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 <div class="directive-section"><h2><a name="Dav" id="Dav">Dav</a> <a name="dav" id="dav">Directive</a></h2>
 <table class="directive">
 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Enable WebDAV HTTP methods</td></tr>
 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>Dav On|Off|<var>provider-name</var></code></td></tr>
 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>Dav Off</code></td></tr>
 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory</td></tr>
 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_dav</td></tr>
 </table>
     <p>Use the <code class="directive">Dav</code> directive to enable the
     WebDAV HTTP methods for the given container:</p>

     <div class="example"><p><code>
       &lt;Location /foo&gt;<br />
       <span class="indent">
         Dav On<br />
       </span>
       &lt;/Location&gt;
     </code></p></div>

     <p>The value <code>On</code> is actually an alias for the default
     provider <code>filesystem</code> which is served by the <code class="module"><a href="../mod/mod_dav_fs.html">mod_dav_fs</a></code> module. Note, that once you have DAV enabled
     for some location, it <em>cannot</em> be disabled for sublocations.
     For a complete configuration example have a look at the <a href="#example">section above</a>.</p>

     <div class="warning">
       Do not enable WebDAV until you have secured your server. Otherwise
       everyone will be able to distribute files on your system.
     </div>

 </div>
 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 <div class="directive-section"><h2><a name="DavDepthInfinity" id="DavDepthInfinity">DavDepthInfinity</a> <a name="davdepthinfinity" id="davdepthinfinity">Directive</a></h2>
 <table class="directive">
 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Allow PROPFIND, Depth: Infinity requests</td></tr>
 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>DavDepthInfinity on|off</code></td></tr>
 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>DavDepthInfinity off</code></td></tr>
 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host, directory</td></tr>
 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_dav</td></tr>
 </table>
     <p>Use the <code class="directive">DavDepthInfinity</code> directive to
     allow the processing of <code>PROPFIND</code> requests containing the
     header 'Depth: Infinity'. Because this type of request could constitute
     a denial-of-service attack, by default it is not allowed.</p>

 </div>
 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 <div class="directive-section"><h2><a name="DavMinTimeout" id="DavMinTimeout">DavMinTimeout</a> <a name="davmintimeout" id="davmintimeout">Directive</a></h2>
 <table class="directive">
 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Minimum amount of time the server holds a lock on
 a DAV resource</td></tr>
 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>DavMinTimeout <var>seconds</var></code></td></tr>
 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>DavMinTimeout 0</code></td></tr>
 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host, directory</td></tr>
 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_dav</td></tr>
 </table>
     <p>When a client requests a DAV resource lock, it can also
     specify a time when the lock will be automatically removed by
     the server. This value is only a request, and the server can
     ignore it or inform the client of an arbitrary value.</p>

     <p>Use the <code class="directive">DavMinTimeout</code> directive to specify, in
     seconds, the minimum lock timeout to return to a client.
     Microsoft Web Folders defaults to a timeout of 120 seconds; the
     <code class="directive">DavMinTimeout</code> can override this to a higher value
     (like 600 seconds) to reduce the chance of the client losing
     the lock due to network latency.</p>

     <div class="example"><h3>Example</h3><p><code>
       &lt;Location /MSWord&gt;<br />
       <span class="indent">
         DavMinTimeout 600<br />
       </span>
       &lt;/Location&gt;
     </code></p></div>

 </div>
 </div>
 <div class="bottomlang">
 <p><span>Available Languages: </span><a href="../en/mod/mod_dav.html" title="English">&nbsp;en&nbsp;</a> |
 <a href="../ja/mod/mod_dav.html" hreflang="ja" rel="alternate" title="Japanese">&nbsp;ja&nbsp;</a> |
 <a href="../ko/mod/mod_dav.html" hreflang="ko" rel="alternate" title="Korean">&nbsp;ko&nbsp;</a></p>
 </div><div id="footer">
 <p class="apache">Copyright 2013 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p>
 <p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/directives.html">Directives</a> | <a href="../faq/">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p></div>
 </body></html>
	<?xml version="1.0" encoding="ISO-8859-1"?>
	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
	<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head>
	<meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type" />
	<meta content="noindex, nofollow" name="robots" />
	<!--
	XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
	This file is generated from xml source: DO NOT EDIT
	XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
	-->
	<title>mod_dav - Apache HTTP Server</title>
	<link href="../style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" />
	<link href="../style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" />
	<link href="../style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" />
	<link href="../images/favicon.ico" rel="shortcut icon" /><link href="http://httpd.apache.org/docs/current/mod/mod_dav.html" rel="canonical" /></head>
	<body>
	<div id="page-header">
	<p class="menu"><a href="../mod/">Modules</a> \| <a href="../mod/directives.html">Directives</a> \| <a href="../faq/">FAQ</a> \| <a href="../glossary.html">Glossary</a> \| <a href="../sitemap.html">Sitemap</a></p>
	<p class="apache">Apache HTTP Server Version 2.0</p>
	<img alt="" src="../images/feather.gif" /></div>
	<div class="up"><a href="./"><img title="<-" alt="<-" src="../images/left.gif" /></a></div>
	<div id="path">
	<a href="http://www.apache.org/">Apache</a> > <a href="http://httpd.apache.org/">HTTP Server</a> > <a href="http://httpd.apache.org/docs/">Documentation</a> > <a href="../">Version 2.0</a> > <a href="./">Modules</a></div>
	<div id="page-content">
	<div class="retired"><h4>Please note</h4>
	<p>This document refers to the <strong>2.0</strong> version of Apache httpd, which <strong>is no longer maintained</strong>. Upgrade, and refer to the current version of httpd instead, documented at:</p>
	<ul><li><a href="http://httpd.apache.org/docs/current/">Current release version of Apache HTTP Server documentation</a></li></ul><p>You may follow <a href="http://httpd.apache.org/docs/current/mod/mod_dav.html">this link</a> to go to the current version of this document.</p></div><div id="preamble"><h1>Apache Module mod_dav</h1>
	<div class="toplang">
	<p><span>Available Languages: </span><a href="../en/mod/mod_dav.html" title="English"> en </a> \|
	<a href="../ja/mod/mod_dav.html" hreflang="ja" rel="alternate" title="Japanese"> ja </a> \|
	<a href="../ko/mod/mod_dav.html" hreflang="ko" rel="alternate" title="Korean"> ko </a></p>
	</div>
	<table class="module"><tr><th><a href="module-dict.html#Description">Description:</a></th><td>Distributed Authoring and Versioning
	(<a href="http://www.webdav.org/">WebDAV</a>) functionality</td></tr>
	<tr><th><a href="module-dict.html#Status">Status:</a></th><td>Extension</td></tr>
	<tr><th><a href="module-dict.html#ModuleIdentifier">Module Identifier:</a></th><td>dav_module</td></tr>
	<tr><th><a href="module-dict.html#SourceFile">Source File:</a></th><td>mod_dav.c</td></tr></table>
	<h3>Summary</h3>

	<p>This module provides class 1 and class 2 <a href="http://www.webdav.org">WebDAV</a> ('Web-based Distributed
	Authoring and Versioning') functionality for Apache. This
	extension to the HTTP protocol allows creating, moving,
	copying, and deleting resources and collections on a remote web
	server.</p>
	</div>
	<div id="quickview"><h3 class="directives">Directives</h3>
	<ul id="toc">
	<li><img alt="" src="../images/down.gif" /> <a href="#dav">Dav</a></li>
	<li><img alt="" src="../images/down.gif" /> <a href="#davdepthinfinity">DavDepthInfinity</a></li>
	<li><img alt="" src="../images/down.gif" /> <a href="#davmintimeout">DavMinTimeout</a></li>
	</ul>
	<h3>Topics</h3>
	<ul id="topics">
	<li><img alt="" src="../images/down.gif" /> <a href="#example">Enabling WebDAV</a></li>
	<li><img alt="" src="../images/down.gif" /> <a href="#security">Security Issues</a></li>
	<li><img alt="" src="../images/down.gif" /> <a href="#complex">Complex Configurations</a></li>
	</ul><h3>See also</h3>
	<ul class="seealso">
	<li><code class="directive"><a href="../mod/mod_dav_fs.html#davlockdb">DavLockDB</a></code></li>
	<li><code class="directive"><a href="../mod/core.html#limitxmlrequestbody">LimitXMLRequestBody</a></code></li>
	<li><a href="http://www.webdav.org">WebDAV Resources</a></li>
	</ul></div>
	<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
	<div class="section">
	<h2><a name="example" id="example">Enabling WebDAV</a></h2>
	<p>To enable <code class="module"><a href="../mod/mod_dav.html">mod_dav</a></code>, add the following to a
	container in your <code>httpd.conf</code> file:</p>

	<div class="example"><p><code>Dav On</code></p></div>

	<p>This enables the DAV file system provider, which is implemented
	by the <code class="module"><a href="../mod/mod_dav_fs.html">mod_dav_fs</a></code> module. Therefore, that module
	must be compiled into the server or loaded at runtime using the
	<code class="directive"><a href="../mod/mod_so.html#loadmodule">LoadModule</a></code> directive.</p>

	<p>In addition, a location for the DAV lock database must be
	specified in the global section of your <code>httpd.conf</code>
	file using the <code class="directive"><a href="../mod/mod_dav_fs.html#davlockdb">DavLockDB</a></code>
	directive:</p>

	<div class="example"><p><code>
	DavLockDB /usr/local/apache2/var/DavLock
	</code></p></div>

	<p>The directory containing the lock database file must be
	writable by the <code class="directive"><a href="../mod/mpm_common.html#user">User</a></code>
	and <code class="directive"><a href="../mod/mpm_common.html#group">Group</a></code> under which
	Apache is running.</p>

	<p>You may wish to add a <code class="directive"><a href="../mod/core.html#limit"><Limit></a></code> clause inside the <code class="directive"><a href="../mod/core.html#location"><Location></a></code> directive to limit access to
	DAV-enabled locations. If you want to set the maximum amount of
	bytes that a DAV client can send at one request, you have to use
	the <code class="directive"><a href="../mod/core.html#limitxmlrequestbody">LimitXMLRequestBody</a></code>
	directive. The "normal" <code class="directive"><a href="../mod/core.html#limitrequestbody">LimitRequestBody</a></code> directive has no effect on DAV
	requests.</p>

	<div class="example"><h3>Full Example</h3><p><code>
	DavLockDB /usr/local/apache2/var/DavLock<br />
	<br />
	<Location /foo><br />
	<span class="indent">
	Dav On<br />
	<br />
	AuthType Basic<br />
	AuthName DAV<br />
	AuthUserFile user.passwd<br />
	<br />
	<LimitExcept GET OPTIONS><br />
	<span class="indent">
	require user admin<br />
	</span>
	</LimitExcept><br />
	</span>
	</Location><br />
	</code></p></div>

	<p><code class="module"><a href="../mod/mod_dav.html">mod_dav</a></code> is a descendent of Greg Stein's <a href="http://www.webdav.org/mod_dav/">mod_dav for Apache 1.3</a>. More
	information about the module is available from that site.</p>
	</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
	<div class="section">
	<h2><a name="security" id="security">Security Issues</a></h2>

	<p>Since DAV access methods allow remote clients to manipulate
	files on the server, you must take particular care to assure that
	your server is secure before enabling <code class="module"><a href="../mod/mod_dav.html">mod_dav</a></code>.</p>

	<p>Any location on the server where DAV is enabled should be
	protected by authentication. The use of HTTP Basic Authentication
	is not recommended. You should use at least HTTP Digest
	Authentication, which is provided by the
	<code class="module"><a href="../mod/mod_auth_digest.html">mod_auth_digest</a></code> module. Nearly all WebDAV clients
	support this authentication method. An alternative is Basic
	Authentication over an <a href="../ssl/">SSL</a> enabled
	connection.</p>

	<p>In order for <code class="module"><a href="../mod/mod_dav.html">mod_dav</a></code> to manage files, it must
	be able to write to the directories and files under its control
	using the <code class="directive"><a href="../mod/mpm_common.html#user">User</a></code> and
	<code class="directive"><a href="../mod/mpm_common.html#group">Group</a></code> under which
	Apache is running. New files created will also be owned by this
	<code class="directive"><a href="../mod/mpm_common.html#user">User</a></code> and <code class="directive"><a href="../mod/mpm_common.html#group">Group</a></code>. For this reason, it is
	important to control access to this account. The DAV repository
	is considered private to Apache; modifying files outside of Apache
	(for example using FTP or filesystem-level tools) should not be
	allowed.</p>

	<p><code class="module"><a href="../mod/mod_dav.html">mod_dav</a></code> may be subject to various kinds of
	denial-of-service attacks. The <code class="directive"><a href="../mod/core.html#limitxmlrequestbody">LimitXMLRequestBody</a></code> directive can be
	used to limit the amount of memory consumed in parsing large DAV
	requests. The <code class="directive"><a href="#davdepthinfinity">DavDepthInfinity</a></code> directive can be
	used to prevent <code>PROPFIND</code> requests on a very large
	repository from consuming large amounts of memory. Another
	possible denial-of-service attack involves a client simply filling
	up all available disk space with many large files. There is no
	direct way to prevent this in Apache, so you should avoid giving
	DAV access to untrusted users.</p>
	</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
	<div class="section">
	<h2><a name="complex" id="complex">Complex Configurations</a></h2>

	<p>One common request is to use <code class="module"><a href="../mod/mod_dav.html">mod_dav</a></code> to
	manipulate dynamic files (PHP scripts, CGI scripts, etc). This is
	difficult because a <code>GET</code> request will always run the
	script, rather than downloading its contents. One way to avoid
	this is to map two different URLs to the content, one of which
	will run the script, and one of which will allow it to be
	downloaded and manipulated with DAV.</p>

	<div class="example"><p><code>
	Alias /phparea /home/gstein/php_files<br />
	Alias /php-source /home/gstein/php_files<br />
	<Location /php-source>
	<span class="indent">
	DAV On<br />
	ForceType text/plain<br />
	</span>
	</Location>
	</code></p></div>

	<p>With this setup, <code>http://example.com/phparea</code> can be
	used to access the output of the PHP scripts, and
	<code>http://example.com/php-source</code> can be used with a DAV
	client to manipulate them.</p>
	</div>
	<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
	<div class="directive-section"><h2><a name="Dav" id="Dav">Dav</a> <a name="dav" id="dav">Directive</a></h2>
	<table class="directive">
	<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Enable WebDAV HTTP methods</td></tr>
	<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>Dav On\|Off\|<var>provider-name</var></code></td></tr>
	<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>Dav Off</code></td></tr>
	<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory</td></tr>
	<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
	<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_dav</td></tr>
	</table>
	<p>Use the <code class="directive">Dav</code> directive to enable the
	WebDAV HTTP methods for the given container:</p>

	<div class="example"><p><code>
	<Location /foo><br />
	<span class="indent">
	Dav On<br />
	</span>
	</Location>
	</code></p></div>

	<p>The value <code>On</code> is actually an alias for the default
	provider <code>filesystem</code> which is served by the <code class="module"><a href="../mod/mod_dav_fs.html">mod_dav_fs</a></code> module. Note, that once you have DAV enabled
	for some location, it <em>cannot</em> be disabled for sublocations.
	For a complete configuration example have a look at the <a href="#example">section above</a>.</p>

	<div class="warning">
	Do not enable WebDAV until you have secured your server. Otherwise
	everyone will be able to distribute files on your system.
	</div>

	</div>
	<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
	<div class="directive-section"><h2><a name="DavDepthInfinity" id="DavDepthInfinity">DavDepthInfinity</a> <a name="davdepthinfinity" id="davdepthinfinity">Directive</a></h2>
	<table class="directive">
	<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Allow PROPFIND, Depth: Infinity requests</td></tr>
	<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>DavDepthInfinity on\|off</code></td></tr>
	<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>DavDepthInfinity off</code></td></tr>
	<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host, directory</td></tr>
	<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
	<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_dav</td></tr>
	</table>
	<p>Use the <code class="directive">DavDepthInfinity</code> directive to
	allow the processing of <code>PROPFIND</code> requests containing the
	header 'Depth: Infinity'. Because this type of request could constitute
	a denial-of-service attack, by default it is not allowed.</p>

	</div>
	<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
	<div class="directive-section"><h2><a name="DavMinTimeout" id="DavMinTimeout">DavMinTimeout</a> <a name="davmintimeout" id="davmintimeout">Directive</a></h2>
	<table class="directive">
	<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Minimum amount of time the server holds a lock on
	a DAV resource</td></tr>
	<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>DavMinTimeout <var>seconds</var></code></td></tr>
	<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>DavMinTimeout 0</code></td></tr>
	<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host, directory</td></tr>
	<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
	<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_dav</td></tr>
	</table>
	<p>When a client requests a DAV resource lock, it can also
	specify a time when the lock will be automatically removed by
	the server. This value is only a request, and the server can
	ignore it or inform the client of an arbitrary value.</p>

	<p>Use the <code class="directive">DavMinTimeout</code> directive to specify, in
	seconds, the minimum lock timeout to return to a client.
	Microsoft Web Folders defaults to a timeout of 120 seconds; the
	<code class="directive">DavMinTimeout</code> can override this to a higher value
	(like 600 seconds) to reduce the chance of the client losing
	the lock due to network latency.</p>

	<div class="example"><h3>Example</h3><p><code>
	<Location /MSWord><br />
	<span class="indent">
	DavMinTimeout 600<br />
	</span>
	</Location>
	</code></p></div>

	</div>
	</div>
	<div class="bottomlang">
	<p><span>Available Languages: </span><a href="../en/mod/mod_dav.html" title="English"> en </a> \|
	<a href="../ja/mod/mod_dav.html" hreflang="ja" rel="alternate" title="Japanese"> ja </a> \|
	<a href="../ko/mod/mod_dav.html" hreflang="ko" rel="alternate" title="Korean"> ko </a></p>
	</div><div id="footer">
	<p class="apache">Copyright 2013 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p>
	<p class="menu"><a href="../mod/">Modules</a> \| <a href="../mod/directives.html">Directives</a> \| <a href="../faq/">FAQ</a> \| <a href="../glossary.html">Glossary</a> \| <a href="../sitemap.html">Sitemap</a></p></div>
	</body></html>