WebDAV over HTTPS: what you actually need

WebDAV over plain HTTP reveals your password, as demonstrated by the ability to sniff Basic Auth credentials transmitted in base64. To secure WebDAV, employ HTTPS in production environments. When comparing authentication methods, Basic Auth offers medium security but remains compatible with virtually all clients. Bearer or token-based authentication, often used in OAuth2 and Nextcloud setups, provides easy implementation and strong security.

Digest Auth, while offering higher security, is less universally supported. Client certificate authentication represents the highest level of security but is niche and requires self-signed PKI.

For home NAS devices, Basic + HTTPS suffices. Public or multi-tenant setups, however, benefit from Digest or OAuth2 + Bearer authentication. Enterprise environments typically employ client certificates along with secure credential storage solutions.

When configuring a WebDAV server on platforms like Synology or QNAP, it uses a self-signed certificate. Browsers issue warnings upon the first encounter. To proceed, either import the exported .crt file into your OS's trust store (Windows users can do this through certmgr.msc) or use Let's Encrypt on the NAS, which supports automatic certificate renewal every 90 days. Firewall configuration should block HTTP/80 entirely, opening only HTTPS/443 (or 5006 for Synology) to prevent unauthorized access.

Clients store credentials differently, utilizing encryption mechanisms like RaiDrive's Windows Credential Manager, Cyberduck's Plaintext (default) or custom encryption, and macOS Finder's Keychain. Sharing a device without proper precautions leaves credentials vulnerable to unauthorized access. Implementing end-to-end encryption (E2EE) on top of HTTPS can further protect sensitive data, with options like rclone crypt or Cryptomator offering AES-encrypted file names and content.

However, combining multiple encryption layers without proper key management can lead to key loss and security breaches. Following these guidelines ensures a secure WebDAV setup tailored to individual needs and risk profiles.