Windows WebDAV Client Support #8
Comments
|
#5 is also still around. |
|
Hello, so I managed to virtualize Windows 11. Connecting via Edge seems to work, at least for reading files. I can see relevant entries in NGINX logs: What would be the steps to connect via WebDAV using "Map Network Drive"? If I use |
|
Hi! There are various ways to connect with the WebDAV Drive, I will List the most common ways for me. I didn't manage to get all of them working, although I know it is possible with some other WebDAV Servers.
Where the Option 1 is just a Quick Connection which is lost after you close the Explorer and Option 2 and 3 are persistet as a Drive in This Computer for later reuse. Give me a notice if you strugle with one or the other Option or if WebDAV isn't working (You don't see connections at the Server) at all, there are some pitfalls with WebDAV in Windows. URL in Windows Explorer
Network Drive
Network Address
|
|
Thank you for the great details, @Akjo4712! I am now able to attempt a connection and will try to see what I can fix. I will open new issues if I find different ones and/or come back here in case I need to ask something generic. |
|
I made some changes but I have not built any new image yet. Before that, could you keep the image you are already using and tell me if you have ever applied this?
(source) If not, could you please try this out with your current image and tell me if it works already? I am asking because I made several changes and then discovered that disabling authentication makes everything work with Windows/Explorer (sort of). And this explains why this solution by @bertmelis is working for them (no auth). To me using that different registry value makes the whole work, with auth. |
|
Setting BasicAuthLevel to 2 seems to fix the Issue where I am unable to reconnect to WebDAV after reboot, although I am prompted with a Login Mask. But Setting BasicAuthLevel to 2 is no good Idea, as it basically only allows Windows to send Basic Authentication Credentials over an unsecure Connection, which is no good Idea as Username and Password are sent in clear text.
I am using an Nginx Reverse Proxy infront of my WebDAV Server which only Listens on the HTTPS Port, HTTP Port is not available. So i am curious why this is improving anything? Windows shouldn't be thinking I am using a HTTP Connection at all. Is it possible, that the WebDAV Backend, as we are Communicationg with HTTP between Reverse Proxy and backend is somehow sending the wrong Protocol (HTTP) in the Location Header or anything else? |
|
@Akjo4712 I wish I knew the answer, but that is the suggested fix by some sources. Perhaps it also changes other behaviors, not only the one to also allow unsecure connections. I do not see issues, though. if you are serving only over SSL/TLS and configure a "https://" endpoint, it will go through SSL/TLS only. Those who might want to use my image with plain connections still require that change. Now, thanks for confirming. Let's move to the next step. Could you try using my |
|
I will gather some Feedback and will come back to you tomorrow. Once again, thanks for your great work on this Image! |
|
@dgraziotin: I will List Issues I find in this Post as I find them. I will be testing for the next few Minutes.
|
|
Point 2 won't likely be solved. It simply allows Windows/Explorer to connect over a non SSL/TLS port. It does not lower security per se. A person takes the decision to serve over a non-SSL/TLS port and that is it. Whether this also unlocks Explorer to somehow access over authenticated SSL/TLS, I have no idea, but it seems to work, and I have seen it recommended in various places. On the remaining points. I cannot reproduce these issues with the -windows image. Here is what the logs say when I attempt the following operations via Explorer. Creation of a new folder (default "New%20folder"), then renamed to "test folder" File -> New -> OpenDocument Text (New%20OpenDocument%20Text.odt), then renamed to "test document". Opening the document (double click on it), writing some lines, saving, closing Cutting the file, entering the folder, pasting into it: Please note that I am doing all these things via HTTP Port 80 as the image is thought to be used that way primarily. I will provide CORS headers for reverse proxy usage, but adding a proxy brings things outside my control. A reverse proxy might, for example, block some HTTP request methods that Explorer wants to use (I know, for example, that Cloudflare Tunnels do not allow Just to check: how are you providing SSL/TLS to the running container? |
|
@Akjo4712 apologies, the inability to create folders and move files into folders via SSL/TLS is still an issue that I can correct from my side. It is still issue #5. The difference now is that it works with HTTP, not with HTTPS. I'll see what I can do. Please tell me anyway how you proxy to the container. |
|
For now I can't reproduce Points 3 and 5, unsure why. WebDAV in Windows is a real mess 🤕. I receive the following Error in Logs when moving a File with WebDAV. I am not sure what is wrong with the Destination Header. Is it the Protocol beeing HTTPS although it expects it to be HTTP, or is it the Port which is 10443 although 80 is expected. SSL Termination is done on a NGINX Container which then Proxies the Requests to the WebDAV Container. Basically it then is NGINX behind NGINX 😆. What I have observed, and this makes me little bit nervous, when i Browse through WebDAV sometimes I don't see my Username in the Logs, so it seems I am Browsing annonymous through the Folders and I can enumerate the File List without authentication. Might there be a Security Issue? |
|
@Akjo4712 I think I fixed it :-) pull CORS still missing. Edit: OK, I see that you use a non-default port for HTTPS. That I have not tested yet. With 80/443 it is working. Your screenshot, by the way, is a variation of bug #5. |
|
Hmmm, still not working for me on my non-default HTTPS Port. I don't exactly understand what the Nginx Error Seems to be triggerd by this Code. |
|
@Akjo4712 hmm that is weird. You are having the issue that I supposedly fixed with the last commit. Could you verify for me that the |
|
I can see the usage of a Variable Find my reverse Proxy configuration below. Is there anything I can do in my reverse Proxy in order to resolve those Issues? |
|
Setting the protocol to HTTP internally is not an issue, no. It is actually correct now (corrected by my previous commit) as my image does not use HTTPS. This is my long shot, without having access to your server. Add:
To your I just tried both Caddy (transparent reverse proxy) and Nginx Proxy Manager. Everything works under Windows (and Finder). If the |
|
I think it was a combination of two Issues which triggerd
But I am still afraid that there might be a Security Issue in your recent changes. It looks like somehow Windows is not sending any Authentication Information which is ignored by the Server and you can Navigate through Folders. Windows seems to not send any authentication when you open, move, delete or create a File, which is not ignored by the Server and is returned with a 401 Unauthenicated, which leads to a Error Messages in Explorer. That you get a 401 when unauthenticated and trying to open, move, delete or create a File of course is correct, but why can i navigate through Folders an enumarete Files when i am unauthenciated and furthermore, why is Windows thinking that it mustn't send authentication in the first place? The Screenshot below shows Log Entrys while I Navigate throught Folders. I can navigate through Folders an enumarete Files. No Authenticated User is logged. The Screenshot below shows Log Entrys when I open, move, delete or create a File, the Server is responding with 401 Unauthorized How to reproduce this Issue on my Computer
How to temporarly resolve the Issue
I will do some additional Tests in the next minutes, but as I can enumarate through Folders without Authentication Information beeing logged, my first Guess would be that this must be some Security Issue in the Image. |
|
Great that it is working now! On your issue, thanks. I gave a look at it, and here is what I found out, using PAW for raw HTTP(S) requests. GET, HEAD, PUT, POST requests unauthenticated get blocked with a 401 Unauthorized (correct). OPTIONS requests must go through without authentication as per CORS specification, but in general, this behavior is anyway recommended as it enables identifying allowed request methods. This is what I do here. PROPFIND requests go through unauthorized for Now, one serious that I found out: DELETE requests work unauthenticated. In the sense that a Other than this little security issue (lol, sorry), we can conclude that it otherwise works, can we? EDIT/PS: I see that Explorer re-connects without asking for username/password, as you describe, if you recreate the share. My suspect is that it caches credentials and reuses them. Indeed, it writes "Connect using different credentials" which implies that the previous ones are stored somewhere
But you did help me find quite an issue here, #15! |
|
#15 Fixed and pushed to dgraziotin/nginx-webdav-nononsense:windows (phew!) |
|
@Akjo4712 you can test |
|
Perfect, think we found and fixed quiet a few Issues (more you than me/we). Seems to be in a usable and stable state for Windows for now. You are correct, Windows maintains a Credential Cache for previous connections. I will test the Image with the Tag allfixed in some days, will be skiing for the next few days. ⛷️😃 |
|
@Akjo4712 thank YOU for taking the time to repot on the issues and for having patience. The image was basically not usable for Microsoft Explorer before you opened your issues. Now it seems to be fine! You can actually go back to the normal tags, I tested further, and there is nothing left for me to be done. I am also closing this issue, but you are welcome to open new ones for each new problem. Have a nice skiing period and great Winter holidays! |
|
Hey @dgraziotin I am still having the "Error 0x80070043 - The network name cannot be found" problem in Windows 10 Explorer. Other clients (browser, WinSCP) work well. Do we still need to patch Windows registry to make it work? |
|
Hi @plashenkov, thanks for reporting this. I think it’s time for a new issue. Before opening it, could you kindly see if
If the first one fixes it, I’m afraid that this is the fix as reported by WebDAV providers. If the second one fixes it, it is likely something that happens with the reverse proxy OR how I’m setting CORS for some reason. If nothing fixes it, definitely new issue request. Thank you! |
…cosign-installer-2.2.1 Bump sigstore/cosign-installer from 2.1.0 to 2.2.1
We are using your Image for some days now, I know that the Windows WebDAV Client is a mess itselfe, but supporting Windows WebDAV is curcial for us, as we need native File Explorer integration for our Project. I would like to help you to find an solve all relevant Problems regarding Windows WebDAV Support. Shall I start one Issue for Windows Support overall, or one Issue for each Problem we face?
After rebooting Windows it is quiet impossible to get WebDAV up and running again. I am getting some generic Error Messages. It works quiet well when it works, but a reboot seems to trigger some Bug which is Hard to Workaround. Removing and readding the Drive, while changing some Parameters seems to get it running again, but I can't figure out what is causing it to work again. It seems as, as long as Windows still knows it is the same WebDAV Server the Issue is present, you need to change config Values until Windows can't determine that it is the same Server.
The text was updated successfully, but these errors were encountered: