WebDAV (Web Distributed Authoring and Versioning) is an HTTP extension that enables clients to create, read, edit, move, and delete files on a remote web server as if it were a writable filesystem.

What is WebDAV? Definition, examples and how it works

WebDAV is an HTTP extension defined in RFC 4918 (which obsoleted RFC 2518). Its full name is Web Distributed Authoring and Versioning. It adds a set of new HTTP methods and headers that turn a web server from a read-only publishing platform into a collaborative, writable filesystem. The protocol is designed for remote authoring: users can edit files directly on the server, manage collections (directories), and control access to resources.

The core additions are new HTTP methods: PROPFIND (retrieves properties and lists collection members), PROPPATCH (sets or removes properties), MKCOL (creates a new collection), COPY, MOVE, LOCK, and UNLOCK. These methods operate alongside standard HTTP verbs like GET, PUT, DELETE, and HEAD. WebDAV also introduces XML-based property handling. Resources can have arbitrary metadata properties set via PROPPATCH, and PROPFIND returns properties in an XML response body. The LOCK method provides simple write-locking to prevent lost updates when multiple clients edit the same resource concurrently, though it is a coarse mechanism and not a full version control system.

WebDAV sits above HTTP/1.1 as an application-layer protocol. It is widely supported by operating systems: macOS and Windows can mount WebDAV shares as network drives or folders using built-in clients. Many content management systems (for example, Apache's mod_dav, Nextcloud, and SharePoint) expose WebDAV interfaces to allow direct file editing and synchronization. It is not a replacement for version control systems such as Git or SVN, but it provides a simpler distributed authoring layer for web resources. A related extension called DeltaV (RFC 3253) adds versioning support on top of WebDAV, though it has seen limited deployment.

Key facts

Defined in RFC 4918, obsoleting RFC 2518, published June 2007.
Adds seven new HTTP methods: PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, LOCK, UNLOCK.
Operates over standard HTTP on port 80 or HTTPS on port 443.
Supports file locking via LOCK/UNLOCK to prevent concurrent overwrites.
Built-in support in major operating systems: Windows Explorer, macOS Finder, Linux GVFS.
Often paired with DeltaV (RFC 3253) for versioning, though rarely implemented in practice.

How it works in practice

A graphic designer uses a WebDAV client (e.g., Cyberduck) mounted to a WebDAV-enabled Apache server. She drags a large Photoshop file from her local machine into the remote 'assets' folder. The client issues a PUT request; the server stores the file and returns a 201 Created. Later, a colleague opens the same folder, also via WebDAV, and adds a new subfolder by creating a new directory with MKCOL. Both users can see live changes without FTP or SCP, and the LOCK method prevents them from overwriting each others edits on the same file simultaneously.

Related terms

HTTP REST CalDAV CardDAV DeltaV mod_dav WebDAV Redirect Reference

References

More in Web Protocols

CORS

CORS (Cross-Origin Resource Sharing) is a browser security mechanism that lets servers explicitly allow web pages from one origin to request resources from a different origin via HTTP response headers.

GraphQL

GraphQL is a query language and runtime for APIs that lets clients request exactly the data they need in a single round trip, reducing over-fetching and under-fetching.

gRPC

gRPC is a high-performance, open-source remote procedure call framework initially developed by Google. It uses HTTP/2 for transport, Protocol Buffers as its interface definition language and message serialization format, and supports bidirectional streaming.

HTTP

HTTP is a text-based request-response protocol that defines how web clients and servers exchange resources, forming the foundation of data communication on the World Wide Web.

HTTP Pipelining

HTTP Pipelining is a technique in HTTP/1.1 that sends multiple requests on a single connection without waiting for each response, now largely replaced by HTTP/2 multiplexing.

HTTP Status Code

A three-digit integer in an HTTP response that indicates the result of the server's attempt to process the request, grouped into five classes (1xx through 5xx).

HTTP/1.1

HTTP/1.1 is the persistent-connection version of the Hypertext Transfer Protocol, defined in RFC 2616 and updated by RFCs 7230-7235, enabling multiple requests and responses over a single TCP connection.

HTTP/2

HTTP/2 is a binary, multiplexed version of HTTP that reduces latency through header compression, stream prioritization, and server push, as defined in RFC 7540.

HTTP/3

HTTP/3 is the third major version of the Hypertext Transfer Protocol, which runs over QUIC instead of TCP to reduce latency, eliminate head-of-line blocking, and improve connection setup time.

HTTPS

HTTPS (HTTP Secure) is HTTP traffic encrypted inside a TLS session, protecting data confidentiality, integrity, and server authenticity between a client and a web server.