Enable CORS for cross-origin WebDAV access

@LukasReschke

It would be great if web applications hosted on a different domain could access Nextcloud files via WebDAV. This would enable web app developers to offer users to store personal application data in their Nextcloud without the need to provide a dedicated Nextcloud app.

Currently this is not possible as the necessary CORS headers are not set.

@LukasReschke

Also related to this as a future step »Dropbox like file picker javascript integration #2028«

@LukasReschke

@LukasReschke what are the next steps here?

I'd like to help as much as I can with this issue - my end goal is to be able to parse the calendar data out with some JS so my personal blog can detail conferences I've spoken at and places I will be speaking soon.

Hit me up if you need to bounce ideas for the solution off someone, or need example use cases etc. I don't have a dev environment for nextcloud set up, but if the problem is a shortage of hands I can take a stab at implementing it if I get some guidance.

@doleraj

@doleraj most often the reason is a shortage of hands, so your help would be much appreciated! :) For any guidance best join our IRC channel #nextcloud-dev or ask here.

Also cc @perry-mitchell for his work on connecting Nextcloud to web apps: https://nextcloud.com/blog/using-webdav-fs-to-access-files-in-nextcloud/ and cc @nextcloud/javascript

We're currently using webdav+Nextcloud to read and write our password archives both in the browser and in NodeJS, using this project (disclaimer: I'm the author). You can see here that we write to the storage without any specifics (besides auth headers).

I don't see why there'd be any problems, but perhaps you might have a specific example in terms of code or cURL etc.? Our library does use a transpiled copy of node-fetch however, which may have some affect on the outcome. It may be that items like native browser fetch somehow behaves differently.

So it seems that at least in out browser extension, it does indeed look like requests to Nextcloud servers (at least the demo ones) are failing with perm errors:

Also seems that I was not so successful in trying to add the Authorization header:

I've been trying with the following JS:

var request = new Request("https://demo.nextcloud.com/vaeshah9/remote.php/webdav/test.txt", {
    method: "GET",
    credentials: "include",
    headers: new Headers({
        Accept: "text/plain",
        Authorization: "Basic " + btoa("admin:admin")
    })
});

fetch(request).then(function(res) {
    console.log(res);
})

At the moment these do look like CORS issues 😕

The "with authentication" thing may be the trick. I'm trying to get at a public calendar without auth since the code'll be running browser-side.

As an example, hitting (https://cloud.arthurdoler.com/remote.php/dav/public-calendars/230G65ZAI9PV9KAT?export ) as an actual URL works fine, causing the .ics to be downloaded.
But trying the following:

const url = 'https://cloud.arthurdoler.com/remote.php/dav/public-calendars/230G65ZAI9PV9KAT?export';
        fetch(url).then((response) => {
            console.log(response)
        });

causes a CORS error:
Fetch API cannot load https://cloud.arthurdoler.com/remote.php/dav/public-calendars/230G65ZAI9PV9KAT?export. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:63342' is therefore not allowed access. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

@georgehrke

Also cc @georgehrke @tcitworld of the Calendar app for @doleraj's specific question. :)

... oops! I apologize, I'd forgotten that Calendar is actually a separate app.

@doleraj

@doleraj But public-calendars is part of the dav app which belongs to the server ;)

@LukasReschke might know more security wise.

We've had a similar issue in bookmarks and ended up having an internal controller being sort of a facade for the public one which incorporates the @CORS annotation. The issue with the later is that it disables sessions. This solution feels more like an ugly hack, however.

I discovered that owncloud/core#28457 is merged upstream, maybe we can integrate this.

@tcitworld

@tcitworld mind opening a pull request to downstream that change? :) Or @LukasReschke what do you say?

Any updates on this?
Anyone partitioned in this issue: How to solve Same Origin Policy in Nextcloud?
What I want to do is send request to WebDAV server from another url. no more, no less.

Hi,

Is this still planned to be worked on someday?

Because the workaround I proposed, while it works and I still use it, breaks some of the standard nextcloud functionalities.

In my case it's usable because I just use that specific nextcloud instance to host the files I need in the other website. But I have to 'disable' it every time I want to add a new file so I can setup the public share in the nextcloud interface.

--

To give some details, I use nextcloud to host/sync my obsidian vault across multiple devices.
And I also use nextcloud to share specific notes and embed their content in a website. That way I dont have to duplicate the content both in obsidian and the site's backend. The notes kinda serve as the backend.

In any case, many thanks for nextcoud :)

@joshyy1312

Hi @joshyy1312
I cannot answer your question, but I want to tell you about another software I am now using (in parallel to Nextcloud) for some synchronising purposes. I am Using PicoDAV, which is a very lightweight WebDAV implementation which perfectly suits some of my needs, where I simply need to synchronise some files. Maybe this would work for Obsidian as well. If you need a Nextcloud compatible Webdav implementation, have a look at KaraDAV, the more feature-rich version of PicoDAV (I have not tried KaraDAV myself, as PicoDAV does all I need).
I still use Nextcloud for the management of my files, but for another purpuse where I simply needed a WebDAV backend to sync files for another software, I have switched to PicoDAV. This might not be suitable for you, or I can understand if you don't want to introduce another tool (as it is another software which needs to be kept up to date), but for my purpose it works very well. Although I would also have prefered if it would have been possible to only use Nextcloud for everything.

Sad to come to this point but in terms of lightweight easy to setup alternatives I can also recommend CopyParty. It is "just" a fileserver with only a markdown editor (and a lot more actually) without a complex plugin system or and ecosystem... but it works and with CORS optionally.

This feature is on our schedule but we cannot yet give an estimation.

Instead of a second server you can still use https://apps.nextcloud.com/apps/webapppassword for this.

@Utopiah

@Utopiah thanks for the suggestion! :)
@susnux thanks for the suggestion too. Could you get it to work? for example with https://diffuse.sh?
I've installed webapppassword on my hetzner (yourstorage, managed nextcloud) and added 'https://diffuse.sh' to the webdav origins-textfield, and added a webdav app password (in security tab).
When adding the webdav credentials to (click 'add music') it errors with nextcloud replying 'Cannot connect to this source'.
I think a musicplayer is a perfect usecase for how nextcloud's webdav can share data with other apps.

@coderofsalvation

@coderofsalvation did you configure the origins in webapppassword?

yes

@susnux

@susnux @pbek were you able to get webapppassword going with webdav-webapps like diffuse.sh?

I never tried that.

Navigation Menu

Repository navigation

Enable CORS for cross-origin WebDAV access #3131

114 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Enable CORS for cross-origin WebDAV access #3131

Description

Activity

jancborchardt commented on Jan 23, 2017

jancborchardt commented on Jan 23, 2017

doleraj commented on Jun 30, 2017

jancborchardt commented on Jun 30, 2017

perry-mitchell commented on Jun 30, 2017

doleraj commented on Jun 30, 2017

jancborchardt commented on Jun 30, 2017

doleraj commented on Jul 1, 2017

georgehrke commented on Jul 1, 2017

blizzz commented on Jul 3, 2017

tcitworld commented on Sep 13, 2017

jancborchardt commented on Sep 13, 2017

mehrdad-shokri commented on Oct 21, 2017

114 remaining items

joshyy1312 commented on Aug 22, 2026

mabuch commented on Aug 22, 2026

Utopiah commented on Aug 23, 2026

susnux commented on Aug 23, 2026

coderofsalvation commented on Aug 25, 2026

pbek commented on Aug 25, 2026

coderofsalvation commented on Aug 25, 2026

coderofsalvation commented on Aug 27, 2026

pbek commented on Aug 27, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions