WebDAV

When your browser loads a web page, it speaks to the computer where the page is stored in a defined language. This language is called HTTP and, by default, is mainly capable of one thing: retrieving content. WebDAV extends this language with commands for writing. This allows a program to not only download files from a remote computer, but also to store them there, rename them, sort them into folders, or delete them. The abbreviation stands for “Web Distributed Authoring and Versioning”, meaning roughly: collaborative editing and versioning over the web. For you as a user, the result often looks like an additional drive that is, in reality, located somewhere in a data center.

Why a network drive without extra software is practical

Before WebDAV, exchanging files over the internet usually required dedicated protocols like FTP. FTP is an older language used purely for file transfer, with its own connections and its own rules. Corporate networks and school networks often block such connections for security reasons. WebDAV, on the other hand, runs over the same channels as ordinary web pages. That’s why it gets through almost anywhere that browsing is allowed.

A second advantage is independence from the provider. WebDAV is an open standard that anyone is allowed to implement. A Nextcloud server at a school, a hosting package, and a commercial cloud can all offer the same interface. A program that supports WebDAV then works with all three. This is the opposite approach to closed systems, where every provider demands its own app.

However, an important distinction must be made: WebDAV is not a synchronization service. Services like Dropbox keep a copy of all files on your device and reconcile changes in the background. WebDAV usually works directly on the server. Without an internet connection, you see nothing at all. This is a common misconception and the reason for frustration when a WebDAV drive suddenly appears empty while on a train.

Locks, folders, and additional commands

Technically, WebDAV adds new commands to the HTTP protocol. PUT stores a file, DELETE removes it, MKCOL creates a folder. COPY and MOVE copy and move files without the data having to take a detour through your computer. This saves a lot of time with large files.

Two commands are especially typical. PROPFIND queries properties, such as file size, modification date, and the contents of a folder. This is exactly how your file manager builds the folder list you see. LOCK blocks a file for others while you are editing it. This prevents two people from saving the same file at the same time, with one overwriting the other’s changes.

You can think of WebDAV like a library with a lending slip. HTTP alone only allows you to look at a book in the reading room. WebDAV additionally allows you to shelve books, put them in the right place, and mark a book as currently checked out. Security here depends entirely on encryption: without HTTPS, the encrypted variant of the connection, passwords and files travel across the network in plain text.

Nextcloud, calendars, and old company servers

You most often encounter WebDAV with self-hosted cloud storage. Nextcloud and ownCloud, which many schools and public authorities use, always offer a WebDAV address. If you enter it in Windows under “Map network drive” or in the macOS Finder under “Connect to Server”, your cloud folder appears in the file manager. Programs like the Android file manager or note-taking apps also use this route.

Two offshoots of the standard are more widespread than many realize. CalDAV transfers appointments, CardDAV transfers contacts. When your phone syncs its calendar and address book with a non-commercial server, this technology is very often behind it. Both are built directly on top of WebDAV.

In the news, WebDAV usually comes up in two contexts. First, in the context of digital sovereignty, when governments demand open standards instead of closed provider apps. Second, in security reports, since poorly secured WebDAV access is a popular target for attackers. The protocol is no longer modern, and many new services rely on their own interfaces instead. Still, it hasn’t disappeared, because it’s already built in almost everywhere.