Questions about potential security issues with the Web site that WebDAV brings

WebDAV: Distributed Authoring and Versioning Protocol (web-based distributed Authoring and Versioning) a communication protocol based on the HTTP 1.1 protocol. It extends HTTP 1.1, adding new methods beyond the Get, POST, head, and other HTTP standard methods, enabling applications to directly read and write to the Web server and support write file locking (Locking) and Unlock (Unlock). You can also support version control for files.

HTTP 1.1 (see IETF RFC 2068) provides a set of methods for client-to-server communication and specifies the format of the response (the client that makes the request is returned from the server). WebDAV takes full account of all the methods in this specification, extends some of these methods, and introduces other methods that provide the described functionality. The methods used in WebDAV include: 1. Options, Head, and Trace. It is used primarily by applications to discover and track service support and network behavior. 2.Get. Retrieves a document. 3.Put and Post. Submits the document to the server. 4.Delete. Destroys a resource or collection. 5. Mkcol. Creates a collection. 6.PropFind and PropPatch. Retrieves and sets properties for resources and collections. 7.Copy and Move. Manages collections and resources in the context of a namespace. 8. Lock and Unlock. Overwrite protection.

In layman's terms, the protocol allows us to manipulate files on remote servers through the HTTP protocol, including writing, deleting, updating, and so on.

Understanding this, it seems, if the protocol is opened in a Web service, it means that a malicious attacker opens up a new and convenient way to attack the server and can easily cause bad effects.

The information on the Internet says that the Web service should be disabled for this protocol, and for Tomcat it seems that the default is not to enable support for the WebDAV protocol. But a lot of people's blogs have written about how to turn off HTTP in Web. XML in a less common or unsafe way, close the code as follows, add to Web. xml:

<security-constraint>    <web-resource-collection>     <url-pattern>/*</url-pattern>     
What is not understood at the moment is:
What is the significance of the WebDAV protocol being so insecure?
Tomcat does not open the support of the WebDAV protocol by default, is it a bit superfluous to disable put, delete, and so on?
Some security vulnerability scanning software, will support the options method as a WebDAV extension vulnerability, so appropriate?
I look forward to the great God to give you advice ...
Questions about potential security issues with the Web site that WebDAV brings