Steps to reproduce
-
Download FileExplorer or Neutron Music Player
-
Try to access Nextcloud via WedDav with
example.com/nextcloud/remote.php/dav/files/USERNAME/orexample.com/nextcloud/remote.php/webdav/files/USERNAME/ -
Error 405 (emtpy directory on Neutron Music Player).
-
/var/log/apache2/access.log
X.X.X.X - - [30/Jan/2020:12:14:06 +0100] "PROPFIND /nextcloud/remote.php/dav/files/admin/ HTTP/1.1" 301 595 "-" "-" X.X.X.X - - [30/Jan/2020:12:14:06 +0100] "PROPFIND /nextcloud/remote.php/dav/files/admin/ HTTP/1.1" 405 3900 "http://X.X.X.X/nextcloud/remote.php/dav/files/admin/" "-"
Expected behaviour
No error 405, ability to browse Nextcloud
Actual behaviour
Error 405, emtpy folder or unable to access
Server configuration
Operating system: Kubuntu 19
Web server: Apache2 2.4
Database: mariadb
PHP version: 7.3
Nextcloud version: 18.0.0
Updated from an older Nextcloud/ownCloud or fresh install: fresh install
Where did you install Nextcloud from: wget
Signing status:
Signing status
No errors have been found.
List of activated apps:
App list
Enabled:
- accessibility: 1.4.0
- activity: 2.11.0
- audioplayer: 2.9.0
- breezedark: 18.0.1
- bruteforcesettings: 1.5.0
- calendar: 2.0.1
- cloud_federation_api: 1.1.0
- comments: 1.8.0
- contacts: 3.1.8
- dav: 1.14.0
- federatedfilesharing: 1.8.0
- federation: 1.8.0
- files: 1.13.1
- files_external: 1.9.0
- files_pdfviewer: 1.7.0
- files_rightclick: 0.15.2
- files_sharing: 1.10.1
- files_trashbin: 1.8.0
- files_versions: 1.11.0
- files_videoplayer: 1.7.0
- firstrunwizard: 2.7.0
- logreader: 2.3.0
- lookup_server_connector: 1.6.0
- mail: 1.1.2
- nextcloud_announcements: 1.7.0
- notifications: 2.6.0
- oauth2: 1.6.0
- onlyoffice: 4.1.4
- password_policy: 1.8.0
- photos: 1.0.0
- privacy: 1.2.0
- provisioning_api: 1.8.0
- recommendations: 0.6.0
- serverinfo: 1.8.0
- settings: 1.0.0
- sharebymail: 1.8.0
- support: 1.1.0
- survey_client: 1.6.0
- systemtags: 1.8.0
- text: 2.0.0
- theming: 1.9.0
- twofactor_backupcodes: 1.7.0
- updatenotification: 1.8.0
- viewer: 1.2.0
- workflowengine: 2.0.0
Disabled:
- admin_audit
- encryption
- music
- occweb
- user_ldap
Nextcloud configuration:
Config report
{
"system": {
"instanceid": "***REMOVED SENSITIVE VALUE***",
"passwordsalt": "***REMOVED SENSITIVE VALUE***",
"secret": "***REMOVED SENSITIVE VALUE***",
"trusted_domains": [
"MY.DOMAIN"
],
"datadirectory": "***REMOVED SENSITIVE VALUE***",
"dbtype": "mysql",
"version": "18.0.0.10",
"overwrite.cli.url": "https:\/\/MY.DOMAIN",
"dbname": "***REMOVED SENSITIVE VALUE***",
"dbhost": "***REMOVED SENSITIVE VALUE***",
"dbport": "",
"dbtableprefix": "oc_",
"mysql.utf8mb4": true,
"dbuser": "***REMOVED SENSITIVE VALUE***",
"dbpassword": "***REMOVED SENSITIVE VALUE***",
"installed": true,
"memcache.local": "\\OC\\Memcache\\APCu",
"maintenance": false
}
}
Are you using external storage, if yes which one: smb
Are you using encryption: no
Are you using an external user-backend, if yes which one: WebDav
Client configuration
Browser: apps
Operating system: Android & iOS
Logs
Web server error log
Web server error log
[Thu Jan 30 00:13:54.802744 2020] [mpm_event:notice] [pid 14643:tid 140116487334976] AH00489: Apache/2.4.41 (Ubuntu) configured -- resuming normal operations
[Thu Jan 30 00:13:54.802841 2020] [core:notice] [pid 14643:tid 140116487334976] AH00094: Command line: '/usr/sbin/apache2'
[Thu Jan 30 00:13:58.259736 2020] [mpm_event:notice] [pid 14643:tid 140116487334976] AH00491: caught SIGTERM, shutting down
[Thu Jan 30 00:13:58.329155 2020] [mpm_prefork:notice] [pid 16111] AH00163: Apache/2.4.41 (Ubuntu) configured -- resuming normal operations
[Thu Jan 30 00:13:58.329235 2020] [core:notice] [pid 16111] AH00094: Command line: '/usr/sbin/apache2'
[Thu Jan 30 00:13:58.651705 2020] [mpm_prefork:notice] [pid 16111] AH00169: caught SIGTERM, shutting down
[Thu Jan 30 00:13:58.781204 2020] [mpm_prefork:notice] [pid 16173] AH00163: Apache/2.4.41 (Ubuntu) configured -- resuming normal operations
[Thu Jan 30 00:13:58.781256 2020] [core:notice] [pid 16173] AH00094: Command line: '/usr/sbin/apache2'
[Thu Jan 30 00:16:04.136927 2020] [mpm_prefork:notice] [pid 16173] AH00171: Graceful restart requested, doing restart
[Thu Jan 30 00:16:04.180073 2020] [mpm_prefork:notice] [pid 16173] AH00163: Apache/2.4.41 (Ubuntu) configured -- resuming normal operations
[Thu Jan 30 00:16:04.180084 2020] [core:notice] [pid 16173] AH00094: Command line: '/usr/sbin/apache2'
[Thu Jan 30 00:16:50.287310 2020] [mpm_prefork:notice] [pid 16173] AH00171: Graceful restart requested, doing restart
[Thu Jan 30 00:16:50.332731 2020] [mpm_prefork:notice] [pid 16173] AH00163: Apache/2.4.41 (Ubuntu) configured -- resuming normal operations
[Thu Jan 30 00:16:50.332740 2020] [core:notice] [pid 16173] AH00094: Command line: '/usr/sbin/apache2'
[Thu Jan 30 00:16:58.076415 2020] [mpm_prefork:notice] [pid 16173] AH00171: Graceful restart requested, doing restart
[Thu Jan 30 00:16:58.122190 2020] [mpm_prefork:notice] [pid 16173] AH00163: Apache/2.4.41 (Ubuntu) configured -- resuming normal operations
[Thu Jan 30 00:16:58.122201 2020] [core:notice] [pid 16173] AH00094: Command line: '/usr/sbin/apache2'
[Thu Jan 30 00:17:00.541912 2020] [mpm_prefork:notice] [pid 16173] AH00171: Graceful restart requested, doing restart
[Thu Jan 30 00:17:00.588455 2020] [mpm_prefork:notice] [pid 16173] AH00163: Apache/2.4.41 (Ubuntu) OpenSSL/1.1.1c configured -- resuming normal operations
[Thu Jan 30 00:17:00.588464 2020] [core:notice] [pid 16173] AH00094: Command line: '/usr/sbin/apache2'
[Thu Jan 30 00:17:11.777080 2020] [mpm_prefork:notice] [pid 16173] AH00171: Graceful restart requested, doing restart
[Thu Jan 30 00:17:11.824231 2020] [mpm_prefork:notice] [pid 16173] AH00163: Apache/2.4.41 (Ubuntu) OpenSSL/1.1.1c configured -- resuming normal operations
[Thu Jan 30 00:17:11.824245 2020] [core:notice] [pid 16173] AH00094: Command line: '/usr/sbin/apache2'
[Thu Jan 30 00:21:50.231699 2020] [php7:error] [pid 19145] [client X.X.X.X:1024] PHP Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 315841760 bytes) in /var/www/nextcloud/lib/private/Installer.php on line 278
[Thu Jan 30 00:23:54.209871 2020] [mpm_prefork:notice] [pid 16173] AH00169: caught SIGTERM, shutting down
[Thu Jan 30 00:23:54.355487 2020] [mpm_prefork:notice] [pid 19208] AH00163: Apache/2.4.41 (Ubuntu) OpenSSL/1.1.1c configured -- resuming normal operations
[Thu Jan 30 00:23:54.355533 2020] [core:notice] [pid 19208] AH00094: Command line: '/usr/sbin/apache2'
[Thu Jan 30 00:24:26.037974 2020] [mpm_prefork:notice] [pid 19208] AH00169: caught SIGTERM, shutting down
[Thu Jan 30 00:24:26.127796 2020] [mpm_prefork:notice] [pid 19592] AH00163: Apache/2.4.41 (Ubuntu) OpenSSL/1.1.1c configured -- resuming normal operations
[Thu Jan 30 00:24:26.127832 2020] [core:notice] [pid 19592] AH00094: Command line: '/usr/sbin/apache2'
[Thu Jan 30 00:25:23.243364 2020] [mpm_prefork:notice] [pid 19592] AH00169: caught SIGTERM, shutting down
[Thu Jan 30 00:25:23.373405 2020] [mpm_prefork:notice] [pid 19663] AH00163: Apache/2.4.41 (Ubuntu) OpenSSL/1.1.1c configured -- resuming normal operations
[Thu Jan 30 00:25:23.373457 2020] [core:notice] [pid 19663] AH00094: Command line: '/usr/sbin/apache2'
[Thu Jan 30 00:27:20.858180 2020] [php7:error] [pid 19678] [client X.X.X.X:58194] script '/var/www/html/status.php' not found or unable to stat
[Thu Jan 30 00:27:21.194181 2020] [php7:error] [pid 19667] [client X.X.X.X:58214] script '/var/www/html/status.php' not found or unable to stat
[Thu Jan 30 00:27:22.373346 2020] [php7:error] [pid 19666] [client X.X.X.X:58216] script '/var/www/html/status.php' not found or unable to stat
[Thu Jan 30 00:27:28.204254 2020] [php7:error] [pid 19691] [client X.X.X.X:58250] script '/var/www/html/status.php' not found or unable to stat
[Thu Jan 30 00:27:29.407814 2020] [php7:error] [pid 19691] [client X.X.X.X:58250] script '/var/www/html/status.php' not found or unable to stat
[Thu Jan 30 00:27:30.716257 2020] [php7:error] [pid 19691] [client X.X.X.X:58250] script '/var/www/html/status.php' not found or unable to stat
[Thu Jan 30 00:35:13.143390 2020] [mpm_prefork:notice] [pid 19663] AH00169: caught SIGTERM, shutting down
[Thu Jan 30 00:35:13.281237 2020] [mpm_prefork:notice] [pid 22295] AH00163: Apache/2.4.41 (Ubuntu) OpenSSL/1.1.1c configured -- resuming normal operations
[Thu Jan 30 00:35:13.281331 2020] [core:notice] [pid 22295] AH00094: Command line: '/usr/sbin/apache2'
[Thu Jan 30 00:36:58.018922 2020] [mpm_prefork:notice] [pid 22295] AH00169: caught SIGTERM, shutting down
[Thu Jan 30 00:36:58.158695 2020] [mpm_prefork:notice] [pid 22349] AH00163: Apache/2.4.41 (Ubuntu) OpenSSL/1.1.1c configured -- resuming normal operations
[Thu Jan 30 00:36:58.158729 2020] [core:notice] [pid 22349] AH00094: Command line: '/usr/sbin/apache2'
[Thu Jan 30 00:47:00.434403 2020] [mpm_prefork:notice] [pid 22349] AH00169: caught SIGTERM, shutting down
[Thu Jan 30 00:47:00.533250 2020] [mpm_prefork:notice] [pid 26070] AH00163: Apache/2.4.41 (Ubuntu) OpenSSL/1.1.1c configured -- resuming normal operations
[Thu Jan 30 00:47:00.533295 2020] [core:notice] [pid 26070] AH00094: Command line: '/usr/sbin/apache2'
[Thu Jan 30 00:48:53.071366 2020] [mpm_prefork:notice] [pid 26070] AH00173: SIGHUP received. Attempting to restart
[Thu Jan 30 00:48:53.118634 2020] [mpm_prefork:notice] [pid 26070] AH00163: Apache/2.4.41 (Ubuntu) OpenSSL/1.1.1c configured -- resuming normal operations
[Thu Jan 30 00:48:53.118654 2020] [core:notice] [pid 26070] AH00094: Command line: '/usr/sbin/apache2'
[Thu Jan 30 00:52:31.375046 2020] [mpm_prefork:notice] [pid 26070] AH00173: SIGHUP received. Attempting to restart
[Thu Jan 30 00:52:31.451051 2020] [mpm_prefork:notice] [pid 26070] AH00163: Apache/2.4.41 (Ubuntu) OpenSSL/1.1.1c configured -- resuming normal operations
[Thu Jan 30 00:52:31.451070 2020] [core:notice] [pid 26070] AH00094: Command line: '/usr/sbin/apache2'
[Thu Jan 30 01:04:08.183384 2020] [mpm_prefork:notice] [pid 26070] AH00169: caught SIGTERM, shutting down
[Thu Jan 30 01:04:08.314957 2020] [mpm_prefork:notice] [pid 30075] AH00163: Apache/2.4.41 (Ubuntu) OpenSSL/1.1.1c configured -- resuming normal operations
[Thu Jan 30 01:04:08.315083 2020] [core:notice] [pid 30075] AH00094: Command line: '/usr/sbin/apache2'
[Thu Jan 30 01:05:39.972823 2020] [mpm_prefork:notice] [pid 30075] AH00169: caught SIGTERM, shutting down
[Thu Jan 30 01:07:41.734724 2020] [mpm_prefork:notice] [pid 985] AH00163: Apache/2.4.41 (Ubuntu) OpenSSL/1.1.1c configured -- resuming normal operations
[Thu Jan 30 01:07:41.735211 2020] [core:notice] [pid 985] AH00094: Command line: '/usr/sbin/apache2'
[Thu Jan 30 01:09:45.782914 2020] [mpm_prefork:notice] [pid 985] AH00169: caught SIGTERM, shutting down
[Thu Jan 30 01:09:45.871762 2020] [mpm_prefork:notice] [pid 1414] AH00163: Apache/2.4.41 (Ubuntu) OpenSSL/1.1.1c configured -- resuming normal operations
[Thu Jan 30 01:09:45.871839 2020] [core:notice] [pid 1414] AH00094: Command line: '/usr/sbin/apache2'
[Thu Jan 30 01:10:13.302149 2020] [mpm_prefork:notice] [pid 1414] AH00169: caught SIGTERM, shutting down
[Thu Jan 30 01:10:13.445562 2020] [mpm_prefork:notice] [pid 1445] AH00163: Apache/2.4.41 (Ubuntu) OpenSSL/1.1.1c configured -- resuming normal operations
[Thu Jan 30 01:10:13.445600 2020] [core:notice] [pid 1445] AH00094: Command line: '/usr/sbin/apache2'
[Thu Jan 30 01:38:36.858128 2020] [php7:error] [pid 1447] [client X.X.X.X:1024] script '/var/www/html/index.php' not found or unable to stat
[Thu Jan 30 01:38:40.702766 2020] [php7:error] [pid 1447] [client X.X.X.X:1024] script '/var/www/html/index.php' not found or unable to stat
[Thu Jan 30 01:38:41.500165 2020] [php7:error] [pid 1447] [client X.X.X.X:1024] script '/var/www/html/index.php' not found or unable to stat
[Thu Jan 30 01:39:06.107185 2020] [php7:error] [pid 1446] [client X.X.X.X:1024] script '/var/www/html/index.php' not found or unable to stat, referer: http://X.X.X.X/
[Thu Jan 30 01:39:11.476948 2020] [php7:error] [pid 1448] [client X.X.X.X:1025] script '/var/www/html/index.php' not found or unable to stat, referer: http://X.X.X.X/
[Thu Jan 30 01:39:12.373031 2020] [php7:error] [pid 1448] [client X.X.X.X:1025] script '/var/www/html/index.php' not found or unable to stat, referer: http://X.X.X.X/
[Thu Jan 30 01:39:15.255480 2020] [php7:error] [pid 1448] [client X.X.X.X:1025] script '/var/www/html/index.php' not found or unable to stat
[Thu Jan 30 01:39:16.890033 2020] [php7:error] [pid 1448] [client X.X.X.X:1025] script '/var/www/html/index.php' not found or unable to stat, referer: http://X.X.X.X/
[Thu Jan 30 01:40:01.579959 2020] [php7:error] [pid 1459] [client X.X.X.X:1028] script '/var/www/html/index.php' not found or unable to stat, referer: http://X.X.X.X/
[Thu Jan 30 01:40:02.058511 2020] [php7:error] [pid 1459] [client X.X.X.X:1028] script '/var/www/html/index.php' not found or unable to stat, referer: http://X.X.X.X/
[Thu Jan 30 01:40:03.365363 2020] [php7:error] [pid 1459] [client X.X.X.X:1028] script '/var/www/html/index.php' not found or unable to stat, referer: http://X.X.X.X/
[Thu Jan 30 01:40:31.108839 2020] [php7:error] [pid 1454] [client X.X.X.X:1024] script '/var/www/html/index.php' not found or unable to stat
[Thu Jan 30 01:44:40.143712 2020] [mpm_prefork:notice] [pid 1445] AH00171: Graceful restart requested, doing restart
[Thu Jan 30 01:44:40.198575 2020] [mpm_prefork:notice] [pid 1445] AH00163: Apache/2.4.41 (Ubuntu) OpenSSL/1.1.1c configured -- resuming normal operations
[Thu Jan 30 01:44:40.198586 2020] [core:notice] [pid 1445] AH00094: Command line: '/usr/sbin/apache2'
[Thu Jan 30 02:37:18.734355 2020] [php7:error] [pid 2798] [client X.X.X.X:10184] PHP Fatal error: Uncaught PDOException: SQLSTATE[40001]: Serialization failure: 1213 Deadlock found when trying to get lock; try restarting transaction in /var/www/nextcloud/3rdparty/doctrine/dbal/lib/Doctrine/DBAL/Driver/PDOStatement.php:117\nStack trace:\n#0 /var/www/nextcloud/3rdparty/doctrine/dbal/lib/Doctrine/DBAL/Driver/PDOStatement.php(117): PDOStatement->execute(NULL)\n#1 /var/www/nextcloud/3rdparty/doctrine/dbal/lib/Doctrine/DBAL/Connection.php(1054): Doctrine\\DBAL\\Driver\\PDOStatement->execute()\n#2 /var/www/nextcloud/lib/private/DB/Connection.php(220): Doctrine\\DBAL\\Connection->executeUpdate('UPDATE `oc_file...', Array, Array)\n#3 /var/www/nextcloud/3rdparty/doctrine/dbal/lib/Doctrine/DBAL/Query/QueryBuilder.php(203): OC\\DB\\Connection->executeUpdate('UPDATE `oc_file...', Array, Array)\n#4 /var/www/nextcloud/lib/private/DB/QueryBuilder/QueryBuilder.php(215): Doctrine\\DBAL\\Query\\QueryBuilder->execute()\n#5 /var/www/nextcloud/lib/private/Lock/DBLockingProvider.php(316): OC\\DB\\QueryBuilder\\QueryBuilder->execute()\n#6 [internal in /var/www/nextcloud/3rdparty/doctrine/dbal/lib/Doctrine/DBAL/Driver/AbstractMySQLDriver.php on line 34
Nextcloud log (data/nextcloud.log)
Nextcloud log
EDIT:
I am willing to help solve this problem, so I could provide additional information.
maybe related?
owncloud/core#1210
#17064
#13092
Advertisement
While updating an Apache httpd from 2.2 to 2.4 we encountered a strange problem. The web server is used as a reverse proxy for a WebDAV application.
Therefore the original httpd 2.2 directive allowed a couple of WebDAV methods. It looked similarly to this:
<Location "/dav">
<LimitExcept HEAD GET POST CONNECT PUT DELETE OPTIONS PROPFIND PROPPATCH MKCOL COPY MOVE LOCK UNLOCK TRACE>
Order deny,allow
Allow from all
</LimitExcept>
</Location>
Adapting this to httpd 2.4 was not a big deal:
<Location "/dav">
AllowMethods HEAD GET POST CONNECT PUT DELETE OPTIONS PROPFIND PROPPATCH MKCOL COPY MOVE LOCK UNLOCK TRACE
Require all granted
</Location>
But this didn’t work as expected. While OPTIONS did work, PROPFIND, PROPPATCH, etc. were not. My tests with curl always returned HTTP 405.
curl -X PROPFIND https://example.org/dav
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>405 Method Not Allowed</title>
</head><body>
<h1>Method Not Allowed</h1>
<p>The requested method PROPFIND is not allowed for the URL /.</p>
</body></html>
As it turns out, there’s a bug report from 2013 in the Apache bug tracker for a similar issue. For whatever reason an enabled DirectoryIndex directive blocks the WebDAV methods.
This bug has been fixed in the httpd 2.5 trunk, but not in http 2.4 (and probably never will). Therefore disabling DirectoryIndex is the mandatory workaround:
<Location "/dav">
DirectoryIndex disabled
AllowMethods HEAD GET POST CONNECT PUT DELETE OPTIONS PROPFIND PROPPATCH MKCOL COPY MOVE LOCK UNLOCK TRACE
Require all granted
</Location>
As this issue didn’t arise until production hours and a quick fix was needed, I’ve yet to confirm if mod_dav and mod_dav_fs are even needed. I suspect they are not.
Advertisement
Loading
I just upgraded my test machine from Apache 2.2.29 to 2.4.10 and actually Im getting some issue with webdav module.
If I try to login to a webdav account it works but if I try to list my current directory I got a 405 error.
I know some config as change with this new version, I did some change to get my virtualhost compatible with 2.4.
I got 2 virtualhost actualy all of these are come from my 2.2 setup, I updated them a bit to be ready with 2.4.
One of them works fine with webdav but the second one generate a 405 on listing directory.
Here is my virtualhost who is working:
Apache log :
10.19.87.87 - maxence [02/Jan/2015:16:30:12 +0100] "PROPFIND / HTTP/1.1" 207 6331 "-" "Cyberduck/4.6.1 (16121) (Windows 7/6.1) (x86)"
<VirtualHost *:80>
ServerAdmin info@test.com
DocumentRoot /home/web/working/dev/
ServerName webdav.working.test.net
ServerAlias webdav.working.test.net
ErrorLog /var/log/apache2/net.test.working.webdav-error.log
CustomLog /var/log/apache2/net.test.working.webdav-access.log combined
<Files ".ht*">
allow from all
</Files>
<Directory />
Options FollowSymLinks
AllowOverride None
Require all granted
</Directory>
<Location />
DAV on
AuthName "test WebDAV Storage - working"
AuthType Basic
AuthUserFile /etc/apache2/htpasswd-webdav
<Limit GET POST PUT DELETE PROPFIND PROPPATCH MKCOL COPY DUPLICATE MOVE LOCK UNLOCK OPTIONS HEAD>
Require valid-user
</Limit>
AddType text/html .php .phtml
</Location>
</Virtualhost>
And now, the one who is not working :
Apache Log :
10.19.87.87 - maxence [02/Jan/2015:16:10:54 +0100] "PROPFIND / HTTP/1.1" 405 475 "-" "Cyberduck/4.6.1 (16121) (Windows 7/6.1) (x86)"
<VirtualHost *:80>
ServerAdmin info@test.com
DocumentRoot /home/web/notworking/dev/
ServerName webdav.notworking.test.net
ServerAlias webdav.notworking.test.net
ErrorLog /var/log/apache2/net.test.notworking.webdav-error.log
CustomLog /var/log/apache2/net.test.notworking.webdav-access.log combined
<Files ".ht*">
allow from all
</Files>
<Directory />
Options FollowSymLinks
AllowOverride None
Require all granted
</Directory>
<Location />
DAV on
AuthName "test WebDAV Storage - notworking"
AuthType Basic
AuthUserFile /etc/apache2/htpasswd-webdav
<Limit GET POST PUT DELETE PROPFIND PROPPATCH MKCOL COPY DUPLICATE MOVE LOCK UNLOCK OPTIONS HEAD>
Require valid-user
</Limit>
AddType text/html .php .phtml
</Location>
</Virtualhost>
As you can see my DAV config are exactly the same.
Folders rigth got same configuration :
drwxr-xr-x 7 www-data www-data 26 déc. 24 12:07 dev
If someone got any clue to know why I can’t list my directory, it’ll help me a lot 
Recently I cam across an issue when making HTTP DELETE or PUT requests to API would result in “405 method not allowed” error. After a quick research it turned out to be WebDAV component’s doing in IIS. Let’s re-create this issue locally, and learn how to solve it.
Dummy RESTful API
First, let’s create a very simple Web API for testing. I used Visual Studio 2017 with .NET Core 1.1 and went for an empty WebApi project.
And slightly modified default the default controller to create a dummy RESTful API. Controller’s code below.
Please note I am using “WebApplication4” namespace after my test solution.
IIS set up
Then published the project and set up a new site on IIS.
Make sure you have WebDAV module installed at this point. If you don’t see WebDAV module in your IIS, you need to install it in “Turn Windows Features On or Off” under Internet Information Services > World Wide Web Services > Common HTTP Features. Screenshot below.
To make IIS set up easier I’ve also used “testapi” local domain, and therefore needed to add following line to Windows hosts file:
Now you can make GET, POST, PUT, and DELETE requests to your test API using your favourite REST testing app. I used Postman. And you should get following results.
- GET – 200 “get”
- POST – 201
- PUT/DELETE – “405 method not allowed” (screenshot below)
Congratulations! We’ve just replicated the problem. Now, let’s focus on the fix.
So what is WebDAV?
Per iis.net documentation:
WebDAV is an Internet-based open standard that enables editing Web sites over HTTP and HTTPS connections.
In other words, WebDAV, if configured correctly, allows you to publish content to remote websites, therefore has a tightened security about PUT and DELETE methods to prevent accidental (or intentional:)) content modification. On one hand, it should be possible to configure WebDAV to work nicely with RESTful APIs and allow PUT and DELETE requests, however the less components and modules you have in your system, the less potential security holes you get. For example, MHTML 0-Day Vulnerability Won’t be Patched Tomorrow.
Deleting WebDAV
If you don’t need to use WebDAV, then the easiest and the best way to fix “405 method not allowed” issue is to remove WebDAV from your system. You can easily get this done in “Turn Windows Features On or Off” simply un-ticking the checkbox.
Once WebDAV is deleted, we can make PUT and DELETE calls to our test API successfully, and now the results are:
- GET – 200 “get”
- POST – 201
- PUT – 200 “put”
- DELETE – 204
All set!
Tips and Tricks
In Windows Server OS there are two different menu items for adding and removing features in Server Manager. Screenshot below.
Conclusions
In this blog post we covered setting up a sample RESTful API, installing WebDAV, replicating the “405 method not allowed” issue, and fixed it by removing WebDAV.
WebDAV can cause IIS to block PUT and DELETE calls to an application, and if you don’t use WebDAV, the best solution is to remove WebDAV from your IIS.