Let the WebDAV verbs through Spring Security's firewall

已装运

2026年9月25日 19:04 UTC

作者

Kamo

提交

04f732e

StrictHttpFirewall admits only GET, HEAD, POST, PUT, PATCH, DELETE and OPTIONS, and answered every PROPFIND, PROPPATCH, REPORT, MKCOL and MKCALENDAR to /dav/** with an empty 400 before any handler ran, so no CalDAV or CardDAV client could discover a calendar or address book (found by SP07 Task 37 in production). The firewall now also admits those five verbs; every other check of the strict firewall stays, and TRACE, CONNECT, LOCK and unknown verbs are still refused.