Let the WebDAV verbs through Spring Security's firewall

Змішані

25 вересня 2026 р. о 19:04 UTC

Авторизація

Kamo

Про нас

04f732e

StrictHttpFirewall admits only GET, HEAD, POST, PUT, PATCH, DELETE and OPTIONS, and answered every PROPFIND, PROPPATCH, REPORT, MKCOL and MKCALENDAR to /dav/** with an empty 400 before any handler ran, so no CalDAV or CardDAV client could discover a calendar or address book (found by SP07 Task 37 in production). The firewall now also admits those five verbs; every other check of the strict firewall stays, and TRACE, CONNECT, LOCK and unknown verbs are still refused.