WebDAV MOVE fails behind reverse proxy on a subpath: "Requested uri ... is out of base uri (/webdav.php/)"

[bernd670]

Describe the bug

When FileRise is served under a subpath (/filerise) behind Traefik with StripPrefix, WebDAV MOVE requests fail with 403 Forbidden, because the Destination header contains the public prefix while sabre/dav only knows the base URI /webdav.php/.

Other WebDAV requests (e.g. PROPFIND, GET, PUT) work through the same URL. The Admin panel shows the subpath correctly under "Firewall and Proxy Settings" (Effective base path: /filerise).

Setup

• FileRise: 3.30.0, Docker image error311/filerise-docker:latest
• Reverse proxy: Traefik 3.7, router rule Host(...) && PathPrefix(/filerise), StripPrefix middleware for /filerise (Traefik then sends X-Forwarded-Prefix: /filerise)
• Env: FR_PUBLISHED_URL=https://example.com/filerise, SECURE=true; tried additionally FR_BASE_PATH=/filerise (no change)
• Public WebDAV URL as described in the docs: https://example.com/filerise/webdav.php/

Steps to reproduce

curl -v -X MOVE -u "user:pass" \
  -H "Destination: https://example.com/filerise/webdav.php/target/file.txt" \
  -H "Overwrite: F" \
  "https://example.com/filerise/webdav.php/source/file.txt"

Actual behavior

<d:error xmlns:d="DAV:" xmlns:s="http://sabredav.org/ns">
  <s:sabredav-version>4.7.0</s:sabredav-version>
  <s:exception>Sabre\DAV\Exception\Forbidden</s:exception>
  <s:message>Requested uri (/filerise/webdav.php/webdav/Archiv/2026/09/21/file.csv) is out of base uri (/webdav.php/)</s:message>
</d:error>

Expected behavior

MOVE works like without a subpath, since the docs describe WebDAV under a subpath (https://your-server/files/webdav.php/) and recommend stripping the prefix and sending X-Forwarded-Prefix for container setups.

Workaround

Removing /filerise from the Destination header makes MOVE work. To do this for all clients, I added an Apache snippet in the container (mod_headers):

<IfModule mod_headers.c>
    RequestHeader edit Destination "^(https?://[^/]+)/filerise(/.*)$" "$1$2"
    RequestHeader edit Destination "^/filerise(/.*)$" "$1"
</IfModule>

Question

Is WebDAV MOVE/COPY under a subpath with a stripped prefix supposed to work? If so, could the WebDAV base URI take FR_BASE_PATH / X-Forwarded-Prefix into account (or rewrite the Destination header accordingly)?

Related

• Deploy to a subpath #73 (Deploy to a subpath): concerns the general subpath setup, not WebDAV.

[error311]

Thanks for the detailed report and workaround. Yes, MOVE/COPY should work under the documented subpath setup.
I confirmed the mismatch and prepared a fix for v3.31.0. When the proxy strips the prefix, FileRise now normalizes the Destination header using the effective base path from FR_BASE_PATH or X-Forwarded-Prefix. Deployments that retain the prefix are also supported.

Local MOVE/COPY regression tests pass, including permissions and overwrite checks. I haven’t tested your exact Traefik setup, so once v3.31.0 is available, please retest without the Apache Destination rewrite. Keep X-Forwarded-Prefix configured or set FR_BASE_PATH=/filerise; FR_PUBLISHED_URL alone doesn’t set the effective base path.

[bernd670]

Thanks for the fix! v3.31.0 works correctly with my Traefik setup (StripPrefix + X-Forwarded-Prefix, plus FR_BASE_PATH=/filerise set as well). MOVE/COPY under the /filerise subpath now succeeds without the Apache Destination rewrite workaround. I've removed it. Appreciate the quick turnaround.

[error311]

Thanks for confirming