WebdavServlet (Apache Tomcat 10.1.48 API Documentation)
Description: declaration: package: org.apache.catalina.servlets, class: WebdavServlet

# Class WebdavServlet

java.lang.Object
jakarta.servlet.GenericServlet
jakarta.servlet.http.HttpServlet
org.apache.catalina.servlets.DefaultServlet
org.apache.catalina.servlets.WebdavServlet

All Implemented Interfaces:
  `Servlet, ServletConfig, Serializable, PeriodicEventListener`

public class WebdavServlet extends DefaultServlet implements PeriodicEventListener
This servlet adds support for WebDAV level 3. All the basic HTTP requests are handled by the DefaultServlet.

The WebDAV servlet is only designed for use with path mapping. The WebdavServlet must not be used as the default servlet (i.e. mapped to '/') or with any other mapping types as it will not work in those configurations.

By default, the entire web application is exposed via the WebDAV servlet. Mapping the WebDAV servlet to `/*` provides WebDAV access to all the resources within the web application. To aid separation of normal users and WebDAV users, the WebDAV servlet may be mounted at a sub-path (e.g. `/webdav/*`) which creates an additional mapping for the entire web application under that sub-path, with WebDAV access to all the resources.

By default, the `WEB-INF` and `META-INF` directories are not accessible via WebDAV. This may be changed by setting the `allowSpecialPaths` initialisation parameter to `true`.

It is also possible to enable WebDAV access to a sub-set of the standard web application URL space rather than creating an additional, WebDAV specific mapping. To do this, map the WebDAV servlet to the desired sub-path and set the `serveSubpathOnly` initialisation parameter to `true`.

Security constraints using the same URL pattern as the mapping (e.g. `/webdav/*`) can be used to limit the users with access to WebDAV functionality. Care is required if using security constraints to further limit WebDAV functionality. In particular, administrators should be aware that security constraints apply only to the request URL. Security constraints do not apply to any destination URL associated with the WebDAV operation (such as COPY or MOVE).

If WebDAV functionality is included in a web application where legitimate users may access it via a browser, it is recommended that the application include CORS protection.

To enable WebDAV for a context add the following to web.xml:

    <servlet>
     <servlet-name>webdav</servlet-name>
     <servlet-class>org.apache.catalina.servlets.WebdavServlet</servlet-class>
       <init-param>
         <param-name>debug</param-name>
         <param-value>0</param-value>
       </init-param>
       <init-param>
         <param-name>listings</param-name>
         <param-value>true</param-value>
       </init-param>
     </servlet>
     <servlet-mapping>
       <servlet-name>webdav</servlet-name>
       <url-pattern>/*</url-pattern>
     </servlet-mapping>

This will enable read only access with folder listings enabled. To enable read-write access add:

     <init-param>
       <param-name>readonly</param-name>
       <param-value>false</param-value>
     </init-param>

To make the content editable via a different URL, use the following mapping:

     <servlet-mapping>
       <servlet-name>webdav</servlet-name>
       <url-pattern>/webdavedit/*</url-pattern>
     </servlet-mapping>

By default, access to /WEB-INF and META-INF are not available via WebDAV. To enable access to these URLs, add:

     <init-param>
       <param-name>allowSpecialPaths</param-name>
       <param-value>true</param-value>
     </init-param>

Don't forget to secure access appropriately to the editing URLs, especially if allowSpecialPaths is used. With the mapping configuration above, the context will be accessible to normal users as before. Those users with the necessary access will be able to edit content available via http://host:port/context/content using http://host:port/context/webdavedit/content

The Servlet provides support for arbitrary dead properties on all resources (dead properties are properties whose values are not protected by the server, such as the content length of a resource). By default, the Servlet will use non persistent memory storage for them. Persistence can be achieved by implementing the `PropertyStore` interface and configuring the Servlet to use that store. The `propertyStore` init-param allows configuring the class name of the store to use, while the parameters in the form of `store.xxx` will be set on the store object as bean properties. For example, this would configure a store with class `com.MyPropertyStore`, and set its property `myName` to value `myValue`:

     <init-param>
       <param-name>propertyStore</param-name>
       <param-value>com.MyPropertyStore</param-value>
     </init-param>
     <init-param>
       <param-name>store.myName</param-name>
       <param-value>myValue</param-value>
     </init-param>

See Also:
  - RFC 4918
  - Serialized Form

- ## Nested Class Summary

  Nested Classes
  Modifier and Type
  Class
  Description
  `static class`
  `WebdavServlet.MemoryPropertyStore`
  Default property store, which provides memory storage without persistence.
  `static interface`
  `WebdavServlet.PropertyStore`
  Handling of dead properties on resources.
  `static enum`
  `WebdavServlet.PropertyUpdateType`
  Type of property update in a PROPPATCH.
  `static enum`
  `WebdavServlet.PropfindType`
  Type of PROPFIND request.
  `static class`
  `WebdavServlet.ProppatchOperation`
  Represents a PROPPATCH sub operation to be performed.

  ### Nested classes/interfaces inherited from class DefaultServlet

  `DefaultServlet.CompressionFormat, DefaultServlet.SortManager`

- ## Field Summary

  Fields
  Modifier and Type
  Field
  Description
  `protected static final ConcurrentDateFormat`
  `creationDateFormat`
  Simple date format for the creation date ISO representation (partial).
  `protected static final String`
  `DEFAULT_NAMESPACE`
  Default namespace.
  `protected static final String`
  `LOCK_SCHEME`
  Lock scheme used.
  `protected static final String`
  `SUPPORTED_LOCKS`
  Pre generated raw XML for supported locks.

  ### Fields inherited from class DefaultServlet

  `BUFFER_SIZE, compressionFormats, contextXsltFile, debug, fileEncoding, FULL, globalXsltFile, input, listings, localXsltFile, mimeSeparation, output, readmeFile, readOnly, resources, sendfileSize, showServerInfo, sm, sortListings, sortManager, useAcceptRanges`

  ### Fields inherited from class HttpServlet

  `LEGACY_DO_HEAD`

- ## Constructor Summary

  Constructors
  Constructor
  Description
  `WebdavServlet()`

- ## Method Summary

  Modifier and Type
  Method
  Description
  `protected boolean`
  `checkIfHeaders(HttpServletRequest request, HttpServletResponse response, WebResource resource)`
  Check if the conditions specified in the optional If headers are satisfied.
  `void`
  `destroy()`
  Called by the servlet container to indicate to a servlet that the servlet is being taken out of service.
  `protected String`
  `determineMethodsAllowed(HttpServletRequest req)`
  Determines the methods normally allowed for the resource.
  `protected void`
  `doCopy(HttpServletRequest req, HttpServletResponse resp)`
  COPY Method.
  `protected void`
  `doDelete(HttpServletRequest req, HttpServletResponse resp)`
  Called by the server (via the `service` method) to allow a servlet to handle a DELETE request.
  `protected void`
  `doLock(HttpServletRequest req, HttpServletResponse resp)`
  LOCK Method.
  `protected void`
  `doMkcol(HttpServletRequest req, HttpServletResponse resp)`
  MKCOL Method.
  `protected void`
  `doMove(HttpServletRequest req, HttpServletResponse resp)`
  MOVE Method.
  `protected void`
  `doOptions(HttpServletRequest req, HttpServletResponse resp)`
  Override default implementation to ensure that TRACE is correctly handled.
  `protected void`
  `doPropfind(HttpServletRequest req, HttpServletResponse resp)`
  PROPFIND Method.
  `protected void`
  `doProppatch(HttpServletRequest req, HttpServletResponse resp)`
  PROPPATCH Method.
  `protected void`
  `doPut(HttpServletRequest req, HttpServletResponse resp)`
  Called by the server (via the `service` method) to allow a servlet to handle a PUT request.
  `protected void`
  `doUnlock(HttpServletRequest req, HttpServletResponse resp)`
  UNLOCK Method.
  `protected DocumentBuilder`
  `getDocumentBuilder()`
  Return JAXP document builder instance.
  `protected String`
  `getPathPrefix(HttpServletRequest request)`
  Determines the appropriate path to prepend resources with when generating directory listings.
  `protected String`
  `getRelativePath(HttpServletRequest request, boolean allowEmptyPath)`
  Override the DefaultServlet implementation and only use the PathInfo.
  `void`
  `init()`
  A convenience method which can be overridden so that there's no need to call `super.init(config)`.
  `void`
  `periodicEvent()`
  Execute a periodic task, such as reloading, etc.
  `protected void`
  `service(HttpServletRequest req, HttpServletResponse resp)`
  Receives standard HTTP requests from the public `service` method and dispatches them to the `do`Method methods defined in this class.

  ### Methods inherited from class DefaultServlet

  `checkIfMatch, checkIfModifiedSince, checkIfNoneMatch, checkIfRange, checkIfUnmodifiedSince, checkSendfile, copy, copy, copy, copy, copyRange, copyRange, copyRange, doGet, doHead, doPost, executePartialPut, findXsltSource, generateETag, getReadme, getRelativePath, isListings, isRangeRequestsSupported, isReadOnly, parseContentRange, parseRange, render, renderHtml, renderSize, renderTimestamp, renderXml, rewriteUrl, sendNotAllowed, serveResource`

  ### Methods inherited from class HttpServlet

  `doTrace, getLastModified, init, service`

  ### Methods inherited from class GenericServlet

  `getInitParameter, getInitParameterNames, getServletConfig, getServletContext, getServletInfo, getServletName, log, log`

  ### Methods inherited from class Object

  `clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

- ## Field Details

  - ### DEFAULT_NAMESPACE

    protected static final String DEFAULT_NAMESPACE
    Default namespace.
    See Also:
      - Constant Field Values

  - ### SUPPORTED_LOCKS

    protected static final String SUPPORTED_LOCKS
    Pre generated raw XML for supported locks.
    See Also:
      - Constant Field Values

  - ### creationDateFormat

    protected static final ConcurrentDateFormat creationDateFormat
    Simple date format for the creation date ISO representation (partial).

  - ### LOCK_SCHEME

    protected static final String LOCK_SCHEME
    Lock scheme used.
    See Also:
      - Constant Field Values

- ## Constructor Details

  - ### WebdavServlet

    public WebdavServlet()

- ## Method Details

  - ### init

    public void init() throws ServletException
    Description copied from class: `jakarta.servlet.GenericServlet`
    A convenience method which can be overridden so that there's no need to call `super.init(config)`.

    Instead of overriding `GenericServlet.init(ServletConfig)`, simply override this method and it will be called by `GenericServlet.init(ServletConfig config)`. The `ServletConfig` object can still be retrieved via `GenericServlet.getServletConfig()`.

    Overrides:
      `init` in class `DefaultServlet`
    Throws:
      `ServletException` - if an exception occurs that interrupts the servlet's normal operation

  - ### destroy

    public void destroy()
    Description copied from class: `jakarta.servlet.GenericServlet`
    Called by the servlet container to indicate to a servlet that the servlet is being taken out of service. See `Servlet.destroy()`.
    Specified by:
      `destroy` in interface `Servlet`
    Overrides:
      `destroy` in class `DefaultServlet`

  - ### periodicEvent

    public void periodicEvent()
    Description copied from interface: `PeriodicEventListener`
    Execute a periodic task, such as reloading, etc.
    Specified by:
      `periodicEvent` in interface `PeriodicEventListener`

  - ### getDocumentBuilder

    protected DocumentBuilder getDocumentBuilder() throws ServletException
    Return JAXP document builder instance.
    Returns:
      the document builder
    Throws:
      `ServletException` - document builder creation failed (wrapped `ParserConfigurationException` exception)

  - ### service

    protected void service(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException
    Description copied from class: `jakarta.servlet.http.HttpServlet`
    Receives standard HTTP requests from the public `service` method and dispatches them to the `do`Method methods defined in this class. This method is an HTTP-specific version of the `Servlet.service(ServletRequest, ServletResponse)` method. There's no need to override this method.
    Overrides:
      `service` in class `DefaultServlet`
    Parameters:
      `req` - the `HttpServletRequest` object that contains the request the client made of the servlet
      `resp` - the `HttpServletResponse` object that contains the response the servlet returns to the client
    Throws:
      `ServletException` - if the HTTP request cannot be handled
      `IOException` - if an input or output error occurs while the servlet is handling the HTTP request
    See Also:
      - `Servlet.service(ServletRequest, ServletResponse)`

  - ### checkIfHeaders

    protected boolean checkIfHeaders(HttpServletRequest request, HttpServletResponse response, WebResource resource) throws IOException
    Description copied from class: `DefaultServlet`
    Check if the conditions specified in the optional If headers are satisfied.
    Overrides:
      `checkIfHeaders` in class `DefaultServlet`
    Parameters:
      `request` - The servlet request we are processing
      `response` - The servlet response we are creating
      `resource` - The resource
    Returns:
      `true` if the resource meets all the specified conditions, and `false` if any of the conditions is not satisfied, in which case request processing is stopped
    Throws:
      `IOException` - an IO error occurred

  - ### getRelativePath

    protected String getRelativePath(HttpServletRequest request, boolean allowEmptyPath)
    Override the DefaultServlet implementation and only use the PathInfo. If the ServletPath is non-null, it will be because the WebDAV servlet has been mapped to a url other than /* to configure editing at different url than normal viewing.
    Overrides:
      `getRelativePath` in class `DefaultServlet`
    Parameters:
      `request` - The servlet request we are processing
      `allowEmptyPath` - Used only to identify a call from DefaultServlet, to avoid removing the trailing slash
    Returns:
      the relative path

  - ### getPathPrefix

    protected String getPathPrefix(HttpServletRequest request)
    Description copied from class: `DefaultServlet`
    Determines the appropriate path to prepend resources with when generating directory listings. Depending on the behaviour of `DefaultServlet.getRelativePath(HttpServletRequest)` this will change.
    Overrides:
      `getPathPrefix` in class `DefaultServlet`
    Parameters:
      `request` - the request to determine the path for
    Returns:
      the prefix to apply to all resources in the listing.

  - ### determineMethodsAllowed

    protected String determineMethodsAllowed(HttpServletRequest req)
    Description copied from class: `DefaultServlet`
    Determines the methods normally allowed for the resource.
    Overrides:
      `determineMethodsAllowed` in class `DefaultServlet`
    Parameters:
      `req` - The Servlet request
    Returns:
      The allowed HTTP methods

  - ### doOptions

    protected void doOptions(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException
    Description copied from class: `DefaultServlet`
    Override default implementation to ensure that TRACE is correctly handled.
    Overrides:
      `doOptions` in class `DefaultServlet`
    Parameters:
      `req` - the `HttpServletRequest` object that contains the request the client made of the servlet
      `resp` - the `HttpServletResponse` object that contains the response the servlet returns to the client
    Throws:
      `ServletException` - if the request for the OPTIONS cannot be handled
      `IOException` - if an input or output error occurs while the servlet is handling the OPTIONS request

  - ### doPropfind

    protected void doPropfind(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException
    PROPFIND Method.
    Parameters:
      `req` - The Servlet request
      `resp` - The Servlet response
    Throws:
      `ServletException` - If an error occurs
      `IOException` - If an IO error occurs

  - ### doProppatch

    protected void doProppatch(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException
    PROPPATCH Method. Dead properties support is a SHOULD in the specification and are not implemented.
    Parameters:
      `req` - The Servlet request
      `resp` - The Servlet response
    Throws:
      `ServletException` - If an error occurs
      `IOException` - If an IO error occurs

  - ### doMkcol

    protected void doMkcol(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException
    MKCOL Method.
    Parameters:
      `req` - The Servlet request
      `resp` - The Servlet response
    Throws:
      `ServletException` - If an error occurs
      `IOException` - If an IO error occurs

  - ### doDelete

    protected void doDelete(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException
    Description copied from class: `jakarta.servlet.http.HttpServlet`
    Called by the server (via the `service` method) to allow a servlet to handle a DELETE request. The DELETE operation allows a client to remove a document or Web page from the server.

    This method does not need to be either safe or idempotent. Operations requested through DELETE can have side effects for which users can be held accountable. When using this method, it may be useful to save a copy of the affected URL in temporary storage.

    If the HTTP DELETE request is incorrectly formatted, `doDelete` returns an HTTP "Bad Request" message.

    Overrides:
      `doDelete` in class `DefaultServlet`
    Parameters:
      `req` - the `HttpServletRequest` object that contains the request the client made of the servlet
      `resp` - the `HttpServletResponse` object that contains the response the servlet returns to the client
    Throws:
      `ServletException` - if the request for the DELETE cannot be handled
      `IOException` - if an input or output error occurs while the servlet is handling the DELETE request

  - ### doPut

    protected void doPut(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException
    Description copied from class: `jakarta.servlet.http.HttpServlet`
    Called by the server (via the `service` method) to allow a servlet to handle a PUT request. The PUT operation allows a client to place a file on the server and is similar to sending a file by FTP.

    When overriding this method, leave intact any content headers sent with the request (including Content-Length, Content-Type, Content-Transfer-Encoding, Content-Encoding, Content-Base, Content-Language, Content-Location, Content-MD5, and Content-Range). If your method cannot handle a content header, it must issue an error message (HTTP 501 - Not Implemented) and discard the request. For more information on HTTP 1.1, see RFC 2616 .

    This method does not need to be either safe or idempotent. Operations that `doPut` performs can have side effects for which the user can be held accountable. When using this method, it may be useful to save a copy of the affected URL in temporary storage.

    If the HTTP PUT request is incorrectly formatted, `doPut` returns an HTTP "Bad Request" message.

    Overrides:
      `doPut` in class `DefaultServlet`
    Parameters:
      `req` - the `HttpServletRequest` object that contains the request the client made of the servlet
      `resp` - the `HttpServletResponse` object that contains the response the servlet returns to the client
    Throws:
      `ServletException` - if the request for the PUT cannot be handled
      `IOException` - if an input or output error occurs while the servlet is handling the PUT request

  - ### doCopy

    protected void doCopy(HttpServletRequest req, HttpServletResponse resp) throws IOException
    COPY Method.
    Parameters:
      `req` - The Servlet request
      `resp` - The Servlet response
    Throws:
      `IOException` - If an IO error occurs

  - ### doMove

    protected void doMove(HttpServletRequest req, HttpServletResponse resp) throws IOException
    MOVE Method.
    Parameters:
      `req` - The Servlet request
      `resp` - The Servlet response
    Throws:
      `IOException` - If an IO error occurs

  - ### doLock

    protected void doLock(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException
    LOCK Method.
    Parameters:
      `req` - The Servlet request
      `resp` - The Servlet response
    Throws:
      `ServletException` - If an error occurs
      `IOException` - If an IO error occurs

  - ### doUnlock

    protected void doUnlock(HttpServletRequest req, HttpServletResponse resp) throws IOException
    UNLOCK Method.
    Parameters:
      `req` - The Servlet request
      `resp` - The Servlet response
    Throws:
      `IOException` - If an IO error occurs