WebDAV Access

Stylus SFTP Server supports WebDAV (RFC 4918) as its fifth file access protocol, alongside SFTP, FTP, FTPS, and the Web File Transfer Portal. WebDAV enables HTTP-based file access — users can mount their home directory as a network drive from Windows Explorer, macOS Finder, or any WebDAV-compatible client.

All operations use the same StorageBackend as the other protocols. The same files, folders, permissions, quotas, and audit trail apply regardless of which protocol a user connects through.

Enabling WebDAV

WebDAV is disabled by default. To enable it, add the <webdav> block to admin-console.xml:

<webdav>
    <enabled>true</enabled>
</webdav>

The WebDAV endpoint runs on the same Tomcat instance as the admin console (default port 9980). No additional service or port configuration is required. After changing the configuration, restart the admin console service for the change to take effect.

Once enabled, the WebDAV endpoint is available at:

http://localhost:9980/webdav/

Authentication

WebDAV uses HTTP Basic Authentication. Credentials are sent with every request (no sessions). The server verifies them against the sftp_users table — the same user accounts used for SFTP, FTP, and Portal access.

Warning HTTP Basic Auth transmits credentials in Base64 encoding (not encrypted) on every request. In production, always use HTTPS to protect credentials on the wire. Configure a TLS connector in server.xml or place a reverse proxy (nginx, IIS ARR) in front of the server.

Read-only users (configured via LDAP group membership or the default-access setting) can browse and download files but cannot upload, delete, rename, or create directories. The server returns 403 Forbidden for write operations on read-only accounts.

Virtual folders + per-folder ACLs WebDAV honors the identity model's folder ACLs the same way SFTP does. When a folder is granted to a group with READ, WebDAV PUT, DELETE, MKCOL, and MOVE against that folder return 403 Forbidden even though the user's global default is read-write. Virtual folders appear alongside the user's personal home when Portal mount routing is enabled (the same switch drives WebDAV). See Organizations & Groups for the full model.

Supported Operations

The following WebDAV methods are supported:

Method	Operation	Description
`OPTIONS`	Capabilities	Returns DAV compliance level and supported methods.
`PROPFIND`	List / Stat	Lists directory contents or retrieves file properties. Supports `Depth: 0` (single item) and `Depth: 1` (immediate children).
`GET`	Download	Downloads a file. On directories, returns an HTML index listing.
`HEAD`	Metadata	Returns file size, content type, and ETag without the body.
`PUT`	Upload	Uploads or overwrites a file. Parent directories are created automatically. Returns `201 Created` or `204 No Content` (overwrite).
`DELETE`	Delete	Deletes a file or directory (recursive).
`MKCOL`	Create directory	Creates a new directory.
`COPY`	Copy	Copies a file or directory. Respects the `Overwrite` header. Uses copy-on-write on the database backend.
`MOVE`	Move / Rename	Moves or renames a file or directory. Respects the `Overwrite` header.
`LOCK`	Lock	Acquires an exclusive write lock. Returns a lock token. Timeout: 30 minutes.
`UNLOCK`	Unlock	Releases a lock by token.
`PROPPATCH`	Set properties	Accepts property change requests (minimal implementation).

Client Setup

Windows Explorer

Windows Explorer can map a WebDAV share as a network drive using the Map Network Drive dialog or the net use command:

net use Z: http://server:9980/webdav /user:username password

Note The Windows WebClient service requires specific configuration for HTTP (non-HTTPS) connections:

Open Registry Editor and navigate to:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WebClient\Parameters
Set BasicAuthLevel to 2 (allows Basic Auth over HTTP).
Restart the WebClient service:
```
net stop WebClient
net start WebClient
```

For HTTPS connections (recommended for production), no registry changes are needed. Windows Explorer natively supports WebDAV over HTTPS on port 443.

Warning When mapping a drive from an elevated (Administrator) command prompt, the drive letter is only visible to the elevated session. Use a non-elevated command prompt so the drive appears in Windows Explorer.

macOS Finder

In Finder, select Go → Connect to Server (Cmd+K) and enter:

http://server:9980/webdav/

Enter your SFTP username and password when prompted. The server will mount as a network volume on the desktop.

Linux (command line)

Use davfs2 to mount WebDAV as a filesystem:

sudo mount -t davfs http://server:9980/webdav/ /mnt/webdav

Or use curl for scripted operations:

# Upload a file
curl -u username:password -T report.csv http://server:9980/webdav/report.csv

# Download a file
curl -u username:password -o report.csv http://server:9980/webdav/report.csv

# List directory
curl -u username:password -X PROPFIND http://server:9980/webdav/

# Create directory
curl -u username:password -X MKCOL http://server:9980/webdav/reports/

# Delete a file
curl -u username:password -X DELETE http://server:9980/webdav/report.csv

Dedicated WebDAV Clients

Any standard WebDAV client can connect, including:

Cyberduck (Windows, macOS)
WinSCP (Windows — supports WebDAV)
Stylus Studio (XML IDE with built-in WebDAV)
Microsoft Office (Open/Save directly to WebDAV URLs)
cadaver (Linux command-line client)

When configuring a client, use the following settings:

Setting	Value
Server URL	`http://server:9980/webdav/`
Authentication	HTTP Basic
Username	Your SFTP username
Password	Your SFTP password

Security

WebDAV enforces the same security standards as the other protocols:

Path traversal prevention — all file paths are validated to stay within the user's home directory. Requests containing ../ sequences are rejected with 403 Forbidden.
Read-only enforcement — write operations (PUT, DELETE, MKCOL, COPY, MOVE) are rejected for read-only accounts.
Shared account lockout — failed WebDAV login attempts count toward the same lockout threshold as SFTP and FTP.
Audit trail — uploads and downloads via WebDAV are recorded in the audit trail with detail: "via webdav".
Advisory file locking — WebDAV LOCK tokens are maintained in memory with a 30-minute timeout. Locks are advisory and required by some clients (e.g., Microsoft Office) for proper operation.

Note WebDAV is disabled by default. Enable it only when HTTP-based file access is needed. For environments exposed to external networks, always use HTTPS and consider placing the server behind a reverse proxy.

Database Backend

When the database storage backend is active, WebDAV operations benefit from the same optimizations as the other protocols:

Copy-on-write — COPY operations are instantaneous regardless of file size. The database shares data chunks between the original and the copy.
Instant move — MOVE operations update a single row (parent directory pointer) rather than copying data.
Atomic overwrite — COPY and MOVE with the Overwrite: T header execute in a single database transaction, preventing partial states.

Integration with Downstream Systems

WebDAV provides an HTTP-native file access path, making it ideal for integration with systems that can consume files via HTTP but lack SFTP support:

Pipeline automation — configure a webhook (UPLOAD_COMPLETE event) to notify a pipeline system when a file arrives. The pipeline fetches the file via a simple HTTP GET to the WebDAV URL. No SFTP library required.
Mounted drive monitoring — mount the WebDAV share as a network drive, then use standard file system watchers to detect new files. Ideal for environments with strict firewall rules (pull-only, no inbound connections required).
Direct URL access — files are accessible via predictable HTTP URLs. Email notifications can include direct download links that recipients open in a browser (Basic Auth prompt).