Set up WebDAV in Nginx by enabling the ngx_http_dav_module, assigning a writable filesystem root and temporary upload directory, and adding dav_methods PUT DELETE MKCOL COPY MOVE; to a dedicated location. Put that location in an HTTPS server block, protect it with authentication and filesystem permissions, then test every method your client actually sends.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Nginx’s built-in DAV support is intentionally limited. It handles core file operations, but clients that depend on PROPFIND, OPTIONS, LOCK, or UNLOCK need a DAV extension module or a different WebDAV implementation. The distinction determines whether a lightweight Nginx configuration is sufficient or a more complete WebDAV service is required.
As an Amazon Associate I earn from qualifying purchases.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallWhat Nginx WebDAV supports—and what it does not
The ngx_http_dav_module is designed for file-management automation over WebDAV. It processes these methods:
| Method | Typical operation | Built-in Nginx support |
|---|---|---|
PUT |
Upload or replace a file | Supported |
DELETE |
Remove a file or directory where permitted | Supported |
MKCOL |
Create a collection (directory) | Supported |
COPY |
Copy a resource | Supported |
MOVE |
Move or rename a resource | Supported |
PROPFIND, OPTIONS, LOCK, UNLOCK |
Properties, capability discovery, and locking | Not covered by the built-in module |
A client can therefore fail during connection or folder browsing even when uploads with PUT would work. Many WebDAV applications begin with OPTIONS or PROPFIND, and synchronization tools may require locking. If those methods are mandatory, plan for the dav-ext module or a dedicated WebDAV implementation rather than treating a 405 response as a permissions problem.
#1 Best Overall
Prerequisites and a safe deployment layout
Use a supported Ubuntu Nginx installation
Install Nginx from Ubuntu packages or the official Nginx repository. Ubuntu’s normal layout keeps configuration under /etc/nginx/ and logs under /var/log/nginx/. A dedicated site file makes the DAV service easier to audit and disable without changing unrelated virtual hosts.
sudo apt update
sudo apt install nginx
nginx -v
nginx -V 2>&1The final command prints the build arguments. Confirm that the build includes the HTTP DAV module (normally shown as --with-http_dav_module). The module is not built by default in every Nginx build. If the argument is absent, the configuration will reject DAV directives such as dav_methods; install a package or build that supplies the module before continuing.
Recommended Free Tools
Choose a dedicated hostname and storage directory
Use a hostname such as dav.example.com and keep uploaded data outside the public site tree whenever possible. In this guide, the filesystem root is /srv/webdav, while the URL is https://dav.example.com/dav/. Because Nginx’s root directive appends the request URI, create a matching /srv/webdav/dav directory for that location.
sudo install -d -m 0750 -o www-data -g www-data /srv/webdav/dav
sudo install -d -m 0750 -o www-data -g www-data /var/lib/nginx/webdav-tempReplace www-data if the Nginx worker account is different. Check the user directive in the main Nginx configuration and make the storage and temporary directories writable by the worker, not by every local user. Keep parent directories traversable and avoid granting broad world-write permissions.
Decide who may write
Filesystem ownership and Nginx authentication solve different problems. Ownership determines what the worker can do on disk; HTTP authentication determines who can reach the location. Use a dedicated group when another local service must read or process files, and grant only the read or write rights that workflow needs.
Create the WebDAV server block
Create a site file such as /etc/nginx/sites-available/webdav. The example below separates the port-80 redirect from the TLS server. It enables the five methods supplied by Nginx’s built-in DAV module, creates missing parent directories for uploads, and assigns permissions to newly created resources.
server {
listen 80;
listen [::]:80;
server_name dav.example.com;
return 301 https://$host$request_uri;
}
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name dav.example.com;
ssl_certificate /etc/letsencrypt/live/dav.example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/dav.example.com/privkey.pem;
auth_basic 'WebDAV';
auth_basic_user_file /etc/nginx/.htpasswd;
location /dav/ {
root /srv/webdav;
client_body_temp_path /var/lib/nginx/webdav-temp;
dav_methods PUT DELETE MKCOL COPY MOVE;
create_full_put_path on;
dav_access group:rw all:r;
limit_except GET {
allow 192.0.2.0/24;
deny all;
}
}
}The certificate paths are examples for a certificate issued for dav.example.com; use the paths created by your certificate tool. The root directive maps a request such as /dav/report.pdf to /srv/webdav/dav/report.pdf. If you choose another URL prefix, create the corresponding directory or adjust the layout deliberately.
What each DAV directive does
root: selects the filesystem base used for the location. It must point to a directory whose permissions allow the Nginx worker to perform the requested operation.client_body_temp_path: tells Nginx where request bodies are staged while uploads are received. The directory must exist and be writable by the worker account, but it should not be exposed as a public download path.dav_methods: enables the supported operations. Listing a method does not bypass Unix permissions or authentication.create_full_put_path on: allows Nginx to create intermediate directories when aPUTrequest names a path whose parents do not yet exist. Without it, clients may need to create every parent with separateMKCOLrequests.dav_access: sets permissions on newly created files and directories. The example gives the group read/write access and everyone else read access. Adapt the rule to your local group and threat model; do not assume that these permissions are appropriate for sensitive data.
The limit_except block is an optional network restriction. In the example, methods other than GET are accepted only from the documentation subnet 192.0.2.0/24. Replace that example range with an address range you control, or remove the block if access is intentionally broader. It is an additional control, not a substitute for authentication or HTTPS.
Enable the site and configure authentication
Activate the server block
sudo ln -s /etc/nginx/sites-available/webdav /etc/nginx/sites-enabled/webdav
sudo nginx -t
sudo systemctl reload nginxIf the default site already claims the same hostname, remove or change that conflicting server block. Always run nginx -t before a reload; a syntax error leaves the running configuration unchanged and identifies the file and line that need correction.
Create a Basic Authentication file
Nginx supports HTTP Basic Authentication through an auth_basic_user_file. On Ubuntu, the htpasswd utility is commonly supplied by the apache2-utils package.
sudo apt install apache2-utils
sudo htpasswd -c /etc/nginx/.htpasswd alice
sudo chown root:www-data /etc/nginx/.htpasswd
sudo chmod 0640 /etc/nginx/.htpasswd
sudo nginx -t
sudo systemctl reload nginxThe -c option creates a new file; omit it when adding another user, otherwise the existing account list will be replaced. Ensure the Nginx worker can read the file through its group and that ordinary users cannot. Basic Authentication sends credentials with each request, so use it only after HTTPS is active.
Put HTTPS in place before sending credentials
Why TLS is part of the setup
Production WebDAV should run over HTTPS. The port-80 server can redirect normal requests to the TLS server, while the port-443 block serves the DAV location and certificate. Keep the hostname consistent between DNS, the Nginx server_name, the certificate, and the client URL.
Use Let’s Encrypt HTTP-01 when appropriate
For an HTTP-01 challenge, port 80 must be reachable from the internet while the certificate is being issued. Certbot’s Nginx plugin can add TLS directives to the matching server block and reload Nginx. Do not block the challenge path with a private-only network rule during issuance. After the certificate is installed, retain a reachable port-80 listener if you want automatic HTTP-to-HTTPS redirection and future HTTP-01 renewals.
If your deployment cannot expose port 80, HTTP-01 is not the right validation method; choose a certificate process that matches your network policy rather than weakening the DAV service.
Test the exact methods your client uses
Do not stop after checking that the login page appears. Test the operations the client sends, using a disposable directory and account first. The following examples use curl; substitute a real username, password, hostname, and test filename.
- Check capability discovery:
curl -i -u alice https://dav.example.com/dav/ -X OPTIONSSome clients require a meaningful
OPTIONSresponse. The built-in DAV module does not implement every WebDAV discovery method, so a failure here may indicate an implementation mismatch rather than a bad password. - Upload a file:
printf 'WebDAV testn' > /tmp/webdav-test.txt curl -i -u alice --upload-file /tmp/webdav-test.txt https://dav.example.com/dav/webdav-test.txtConfirm that the file appears under
/srv/webdav/davand that its owner and mode match yourdav_accesspolicy. - Create a collection:
curl -i -u alice -X MKCOL https://dav.example.com/dav/test-folder/ - Copy and move:
curl -i -u alice -X COPY -H 'Destination: https://dav.example.com/dav/copied.txt' https://dav.example.com/dav/webdav-test.txt curl -i -u alice -X MOVE -H 'Destination: https://dav.example.com/dav/moved.txt' https://dav.example.com/dav/copied.txtThese methods depend on the client sending a destination URI that the server can resolve within the configured location.
- Delete the test resources:
curl -i -u alice -X DELETE https://dav.example.com/dav/moved.txt curl -i -u alice -X DELETE https://dav.example.com/dav/test-folder/ - Probe methods your application may require:
curl -i -u alice -X PROPFIND https://dav.example.com/dav/ curl -i -u alice -X LOCK https://dav.example.com/dav/webdav-test.txt curl -i -u alice -X UNLOCK https://dav.example.com/dav/webdav-test.txtDo not interpret these probes as evidence that the built-in module supports the methods. They reveal whether the chosen client will be compatible with this Nginx build.
Use the client’s own debug or protocol-log mode as well. A graphical client may issue several preliminary requests before its first upload, and the first unsupported method is often the real cause of a generic “connection failed” message.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Diagnose common failures
| Symptom | Likely cause | Action |
|---|---|---|
unknown directive dav_methods or a similar startup error |
The Nginx binary lacks ngx_http_dav_module. |
Inspect nginx -V and install or build an Nginx package that includes the module. |
| Upload returns 403 | The worker cannot write the storage path, the temporary path, or the destination parent. | Check ownership, group membership, directory execute bits, and the client_body_temp_path. Review /var/log/nginx/error.log. |
| Upload returns 409 because a parent is missing | Intermediate directory creation is disabled or the client did not create parents. | Enable create_full_put_path on, or issue MKCOL requests for each parent first. |
PROPFIND, LOCK, or UNLOCK returns 405 |
The built-in module does not cover that method. | Use a DAV extension module or a dedicated WebDAV implementation that supports the client’s required method set. |
| Only the default Nginx page appears | The request matched another server block. | Check the hostname in the client URL, the enabled-site symlink, and conflicting server_name entries. |
| Credentials are rejected repeatedly | The password file path, file permissions, or account entry is wrong, or the client is using an HTTP URL. | Verify the file is readable by Nginx, recreate or update the account without -c, and use the HTTPS URL. |
| Certificate issuance cannot complete | The HTTP-01 validator cannot reach port 80. | Make port 80 reachable for issuance and ensure the challenge request reaches the intended Nginx server block. |
| Files are written to an unexpected directory | The URI-to-filesystem mapping under root was misunderstood. |
Trace the complete request path. With location /dav/ and root /srv/webdav, /dav/name maps below /srv/webdav/dav. |
The error log is the fastest way to distinguish an HTTP-method problem from a Unix-permission problem. After changing ownership, paths, or directives, run sudo nginx -t and reload before repeating the client test.
Choose the implementation by method requirements
| Option | Methods and behavior | When it fits | Trade-offs |
|---|---|---|---|
| Built-in Nginx DAV module | PUT, DELETE, MKCOL, COPY, and MOVE |
Simple file automation with clients that use only these operations | Partial WebDAV support; no built-in locking and property-query coverage |
| Nginx build with a DAV extension | Adds methods outside the core module, depending on the extension and build | Clients that need property queries, locking, or broader WebDAV behavior | Additional module packaging, compatibility, and maintenance responsibility |
| Dedicated WebDAV implementation | Method set and authorization model supplied by that server | Synchronization suites or applications requiring complete WebDAV semantics | Another service to operate, secure, patch, and integrate with Nginx |
Compare candidates on supported methods, authentication and authorization, TLS and certificate automation, package or module maintenance, filesystem permission behavior, and compatibility with the exact client. A server that accepts uploads is not automatically compatible with a client that expects locks and live property queries.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsOperational checklist
- Confirm the Nginx build contains
ngx_http_dav_module. - Create a dedicated storage directory outside the public site root where practical.
- Make both the storage root and
client_body_temp_pathwritable only by the required service account or group. - Enable only
PUT,DELETE,MKCOL,COPY, andMOVEwhen the built-in module is sufficient. - Set
create_full_put_path onwhen clients upload into paths whose parents may not exist. - Use
dav_accessdeliberately; newly created resources inherit the permissions you specify there. - Require HTTPS before accepting Basic Authentication credentials.
- Keep port 80 reachable during HTTP-01 certificate issuance and renewals.
- Apply authentication and, where appropriate,
limit_exceptnetwork restrictions. - Run
sudo nginx -tbefore every reload. - Test upload, directory creation, copy, move, delete, and every extra method required by the client.
- Monitor
/var/log/nginx/error.logwhen a client reports only a generic failure.
Final decision
For a controlled Ubuntu deployment whose clients need core file operations, Nginx’s DAV module provides a compact WebDAV endpoint: define a writable root and temporary path, enable the five supported methods, protect the location with HTTPS and authentication, and verify the resulting filesystem permissions. If the client starts with PROPFIND, depends on LOCK, or requires other methods outside that list, select a DAV extension or a dedicated WebDAV service before troubleshooting the Nginx location as though it were a complete WebDAV server.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
