Questions about potential security issues with the Web site that WebDAV brings

Source: Internet
Author: User

WebDAV: Distributed Authoring and Versioning Protocol (web-based distributed Authoring and Versioning) a communication protocol based on the HTTP 1.1 protocol. It extends HTTP 1.1, adding new methods beyond the Get, POST, head, and other HTTP standard methods, enabling applications to directly read and write to the Web server and support write file locking (Locking) and Unlock (Unlock). You can also support version control for files.

HTTP 1.1 (see IETF RFC 2068) provides a set of methods for client-to-server communication and specifies the format of the response (the client that makes the request is returned from the server). WebDAV takes full account of all the methods in this specification, extends some of these methods, and introduces other methods that provide the described functionality. The methods used in WebDAV include: 1. Options, Head, and Trace. It is used primarily by applications to discover and track service support and network behavior. 2.Get. Retrieves a document. 3.Put and Post. Submits the document to the server. 4.Delete. Destroys a resource or collection. 5. Mkcol. Creates a collection. 6.PropFind and PropPatch. Retrieves and sets properties for resources and collections. 7.Copy and Move. Manages collections and resources in the context of a namespace. 8. Lock and Unlock. Overwrite protection.

In layman's terms, the protocol allows us to manipulate files on remote servers through the HTTP protocol, including writing, deleting, updating, and so on.

Understanding this, it seems, if the protocol is opened in a Web service, it means that a malicious attacker opens up a new and convenient way to attack the server and can easily cause bad effects.

The information on the Internet says that the Web service should be disabled for this protocol, and for Tomcat it seems that the default is not to enable support for the WebDAV protocol. But a lot of people's blogs have written about how to turn off HTTP in Web. XML in a less common or unsafe way, close the code as follows, add to Web. xml:

<security-constraint>    <web-resource-collection>     <url-pattern>/*</url-pattern>     

What is not understood at the moment is:

What is the significance of the WebDAV protocol being so insecure?

Tomcat does not open the support of the WebDAV protocol by default, is it a bit superfluous to disable put, delete, and so on?

Some security vulnerability scanning software, will support the options method as a WebDAV extension vulnerability, so appropriate?

I look forward to the great God to give you advice ...

Questions about potential security issues with the Web site that WebDAV brings

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.