Apache WebDAV服务器频繁出现401与405错误排查求助

问题背景 #

Apache WebDAV服务器原本正常运行数周，近期未修改配置却持续出现两类错误：

• PROPFIND请求先返回401，认证后恢复正常；移除Require valid-user指令后401问题暂时解决，但MKCOL请求仍返回405
• 直接访问Apache本地地址无异常，仅通过Nginx反向代理时出现问题

日志详情 #

192.168.1.2 - - [11/Feb/2023:10:32:11 +0100] "PROPFIND /dt/dt_nginx.dtCloud/ HTTP/1.0" 401 381
192.168.1.2 - dt [11/Feb/2023:10:32:11 +0100] "PROPFIND /dt/dt_nginx.dtCloud/ HTTP/1.0" 207 323
192.168.1.2 - dt [11/Feb/2023:10:32:11 +0100] "GET /dt/dt_nginx.dtCloud/inbox/master.plist HTTP/1.0" 200 224
192.168.1.2 - dt [11/Feb/2023:10:32:11 +0100] "PROPFIND /dt/dt_nginx.dtCloud/inbox/ HTTP/1.0" 207 1830
192.168.1.2 - - [11/Feb/2023:10:32:12 +0100] "PROPFIND /dt/dt_nginx.dtCloud/ HTTP/1.0" 401 381
192.168.1.2 - dt [11/Feb/2023:10:32:13 +0100] "PROPFIND /dt/dt_nginx.dtCloud/ HTTP/1.0" 207 323
192.168.1.2 - dt [11/Feb/2023:10:32:13 +0100] "GET /dt/dt_nginx.dtCloud/7b8b717fa62fddda7fe843879f442edee1fba942ff339ba131e4f01d752316f5/master.plist HTTP/1.0" 200 224
192.168.1.2 - dt [11/Feb/2023:10:32:13 +0100] "PROPFIND /dt/dt_nginx.dtCloud/7b8b717fa62fddda7fe843879f442edee1fba942ff339ba131e4f01d752316f5/ HTTP/1.0" 207 2243
192.168.1.2 - - [11/Feb/2023:10:32:35 +0100] "PROPFIND /dt/dt_nginx.dtCloud/ HTTP/1.0" 401 381
192.168.1.2 - dt [11/Feb/2023:10:32:35 +0100] "PROPFIND /dt/dt_nginx.dtCloud/ HTTP/1.0" 207 323
192.168.1.2 - dt [11/Feb/2023:10:32:35 +0100] "GET /dt/dt_nginx.dtCloud/53cbd346392b8673a03715b8c62f03559f470c38c6c79289f273814a7023841f/master.plist HTTP/1.0" 200 224
192.168.1.2 - dt [11/Feb/2023:10:32:35 +0100] "PROPFIND /dt/dt_nginx.dtCloud/53cbd346392b8673a03715b8c62f03559f470c38c6c79289f273814a7023841f/ HTTP/1.0" 207 2244
192.168.1.2 - dt [11/Feb/2023:10:32:35 +0100] "MKCOL /dt/dt_nginx.dtCloud/ HTTP/1.0" 405 222
192.168.1.2 - dt [11/Feb/2023:10:32:35 +0100] "PROPFIND /dt/dt_nginx.dtCloud/ HTTP/1.0" 207 323
192.168.1.2 - dt [11/Feb/2023:10:32:35 +0100] "MKCOL /dt/dt_nginx.dtCloud/53cbd346392b8673a03715b8c62f03559f470c38c6c79289f273814a7023841f/ HTTP/1.0" 405 222
192.168.1.2 - dt [11/Feb/2023:10:32:35 +0100] "PROPFIND /dt/dt_nginx.dtCloud/53cbd346392b8673a03715b8c62f03559f470c38c6c79289f273814a7023841f/ HTTP/1.0" 207 388
192.168.1.2 - dt [11/Feb/2023:10:32:35 +0100] "MKCOL /dt/dt_nginx.dtCloud/53cbd346392b8673a03715b8c62f03559f470c38c6c79289f273814a7023841f/receipts/ HTTP/1.0" 405 222
192.168.1.2 - dt [11/Feb/2023:10:32:35 +0100] "PROPFIND /dt/dt_nginx.dtCloud/53cbd346392b8673a03715b8c62f03559f470c38c6c79289f273814a7023841f/receipts/ HTTP/1.0" 207 397

现有配置 #

Apache (httpd.conf) #

Listen 21028

LoadModule dav_module lib/httpd/modules/mod_dav.so
LoadModule dav_fs_module lib/httpd/modules/mod_dav_fs.so
LoadModule dav_lock_module lib/httpd/modules/mod_dav_lock.so

DavLockDB /usr/local/etc/httpd/webdavdb/davlock

<VirtualHost 192.168.1.2:21028>
    ServerName my.server.me
    ServerAlias my.server.me
    DocumentRoot /Volumes/E/apache/webdav
    <Directory /Volumes/E/apache/webdav>
        Dav On
        AuthType Digest
        AuthName "webdav"
        AuthUserFile /usr/local/etc/httpd/webdavdb/users.password
        Require valid-user
        Options Indexes FollowSymLinks
        AllowOverride None
    </Directory>
</VirtualHost>

Nginx (nginx.conf) #

server {
    server_name my.server.me;

    location / {
        proxy_pass http://192.168.1.2:12345;
    }

    location /robots.txt {
        return 200 "User-agent: *\nDisallow: /\n";
    }

    proxy_set_header Host              $host;
    proxy_set_header X-Real-IP         $remote_addr;
    proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-Host  $host;
    proxy_set_header X-Forwarded-Port  $server_port;

    listen 443 ssl; # managed by Certbot
    # SSL stuff
}

排查步骤 #

1. 修正Nginx代理端口匹配问题 #

从配置可见，Apache监听21028端口，但Nginx的proxy_pass指向了12345端口，端口不匹配会导致请求无法正确送达WebDAV服务。修改Nginx配置：

location / {
    proxy_pass http://192.168.1.2:21028;
}

2. 解决401重复认证问题 #

日志中PROPFIND请求反复触发401，是因为Nginx默认不转发摘要认证的Authorization头，需在Nginx配置中添加：

proxy_set_header Authorization $http_authorization;
proxy_pass_header  Authorization;

同时，让Apache信任反向代理来源，避免重复验证，在Apache的VirtualHost或Directory段添加：

SetEnvIf X-Forwarded-For "^192.168.1.2$" TRUSTED_PROXY
Require valid-user env=TRUSTED_PROXY

3. 修复MKCOL 405错误 #

405表示请求方法不被允许，WebDAV需要Nginx支持PUT、MKCOL等特殊HTTP方法，在Nginx的location段添加：

# 允许WebDAV所需的HTTP方法
if ($request_method !~ ^(GET|HEAD|POST|PUT|DELETE|MKCOL|PROPFIND|PROPPATCH|COPY|MOVE|LOCK|UNLOCK)$ ) {
    return 405;
}

# 处理MKCOL等方法的请求体转发
proxy_set_header Content-Length $content_length;
proxy_http_version 1.1;
proxy_set_header Connection "";

同时检查是否有其他Nginx规则拦截了WebDAV路径，确保所有请求都能转发到Apache。

4. 验证文件系统权限 #

确认Apache运行用户对/Volumes/E/apache/webdav目录有读写权限，MKCOL创建目录需要足够的文件系统权限，权限不足也会引发405或其他错误。

5. 开启详细日志排查 #

在Nginx中开启详细日志，记录请求头和方法：

log_format webdav_log '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_authorization" "$request_method"';
access_log /var/log/nginx/webdav_access.log webdav_log;

在Apache中开启详细日志，添加到VirtualHost：

LogLevel info ssl:warn
CustomLog /usr/local/etc/httpd/logs/webdav_access.log combined
ErrorLog /usr/local/etc/httpd/logs/webdav_error.log

通过详细日志确认请求是否正确转发、认证头是否传递到位。

内容的提问来源于stack exchange，提问作者Cirrocumulus