WebDAV over HTTPS: what you actually need

WebDAV over plain HTTP exposes your password. Here's how HTTPS + auth choice works in practice.

TL;DR

WebDAV defaults to HTTP/80. If you expose a WebDAV server to the public internet without TLS, anyone on your WiFi can sniff your base64-encoded Basic Auth credentials in a few seconds. Always use HTTPS in production.

Auth choices side-by-side

Method	Security	Compatibility	Notes
Basic Auth	Medium (safe over HTTPS)	Universal	Base64 over HTTPS = fine
Bearer / Token	Easy OAuth2, Nextcloud etc.	Most modern clients
Digest Auth	Higher	Mainstream clients	Hashed, password never goes over wire
Client cert	Highest	Few servers / clients	Niche, self-signed PKI

For home NAS: Basic + HTTPS is enough.
For public / multi-tenant: Digest or OAuth2 + Bearer.
For enterprise: Client certificates plus 1Password-style storage.

Trusting self-signed NAS certs

When you enable WebDAV on Synology / QNAP, the server uses a self-signed cert. Your browser warns you the first time. Two ways forward:

1. Add the cert to your OS trust store. On Windows: certmgr.msc → Trusted Root Certification Authorities → import the .crt you exported from the NAS.
2. Use Let's Encrypt on the NAS (Synology DSM 7+ has built-in ACME). Auto-renew every 90 days.

Firewall rules

• Close HTTP/80 completely.
• Open HTTPS/443 (or 5006 for Synology) only.
• If you only access from home, bind WebDAV to your LAN IP — don't even NAT-port-forward it.

Storage of credentials by client

Client	Storage	Encryption
RaiDrive	Windows Credential Manager	DPAPI
ScsDriver	Custom config	Encrypted with machine key
Cyberduck	~/.duck/	Plaintext by default
macOS Finder	Keychain	OS keychain

If you share your laptop, don't tick "remember password" in any WebDAV client. Use a separate non-admin WebDAV user with directory-scoped permissions.

E2EE on top of WebDAV

HTTPS encrypts only the wire. The server still has plaintext. If your server gets popped, files leak. Layer E2EE for sensitive data:

• rclone crypt — wraps any backend (including WebDAV) with AES-encrypted file names + content
• Cryptomator — creates a vault directory, transparently encrypts before upload

Pick one. Don't combine — that's how you lose keys.

Practical checklist

• [ ] Server runs HTTPS only (no HTTP listener)
• [ ] TLS cert is from Let's Encrypt or trusted CA (not self-signed in prod)
• [ ] Basic Auth over HTTPS for home, Digest / OAuth2 for public
• [ ] WebDAV user has directory-scoped permission, not admin
• [ ] Client stores creds via OS keychain (RaiDrive / ScsDriver), not plaintext
• [ ] Sensitive folders wrapped with rclone crypt or Cryptomator
• [ ] Firewall only exposes 443 / 5006 to the internet, if at all