Let the WebDAV verbs through Spring Security's firewall

Dikirim

25 September 2026 pukul 19.04 UTC

Penulis

Kamo

Commit

04f732e

StrictHttpFirewall admits only GET, HEAD, POST, PUT, PATCH, DELETE and OPTIONS, and answered every PROPFIND, PROPPATCH, REPORT, MKCOL and MKCALENDAR to /dav/** with an empty 400 before any handler ran, so no CalDAV or CardDAV client could discover a calendar or address book (found by SP07 Task 37 in production). The firewall now also admits those five verbs; every other check of the strict firewall stays, and TRACE, CONNECT, LOCK and unknown verbs are still refused.