PAGES
← all tools
◆ General Utilities & Libraries

wsgidav

4.3.1 open-source

WsgiDAV is a generic and extendable WebDAV server written in Python and based on WSGI.

Summary

wsgidav is an open-source WebDAV server, written in Python on WSGI, that turns a directory tree into a network share reachable over HTTP with optional SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. and authentication. It installs via pip and runs as a command-line script on Linux, macOS, or Windows, with options like --auth and --browse for quick setup or a config file for domain controllers such as PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded., htpasswd, or htdigest. It suits developers and system administrators who need a lightweight, scriptable file-sharing endpoint rather than a full NAS appliance or cloud storage service. Recent changelog entries note fixes for CVEs in an example MySQL provider and symlink handling, worth checking before deployment. First committed in 2009, it remains active with 56 contributors, dozens of yearly commits, and a release only 55 days old.

WsgiDAV is a generic and extendable WebDAV server written in Python and based on WSGI.

How wsgidav helps

How do I let a team drop files into a shared folder without setting up a file server appliance?

it turns any directory on the machine into a WebDAV share reachable over plain HTTP or HTTPS, so any WebDAV-capable client can mount it directly

Which folder on this machine is exposed to the network and is it writable by anyone?

the startup log lists each registered share by route and filesystem path along with whether it is read-only or read-write, and warns explicitly when anonymous write access is allowed

Who is allowed to authenticate against this share, and against what existing accounts?

a domain controller setting binds logins to PAM, an Apache htpasswd file, or an htdigest file instead of a separate user database, so access follows accounts that already exist

Is this share's traffic, including credentials, exposed on an untrusted network?

it warns at startup when basic authentication is active without SSL enabled, flagging the exact condition under which passwords would travel in the clear

Am I running a version with a known security hole in the pieces I actually enabled?

the changelog names fixed CVEs by version and clarifies that some, like the MySQL provider injection, only apply to installations that explicitly turned that example module on

all 12 features, with the evidence for each →

Languages

Not documented

Features

12 capabilities · 2 backed by code, an API document or a real run

Built from wsgidav's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

What wsgidav offers you

All capabilities 12 capabilities
WebDAV provider API shipped Exposes an extensible DAV provider interface for serving collections, including hooks for response headers, content streaming, content type, content length, and available quota bytes. 8 releases · 7 other sources · first seen May 2015

release 8 total

  • --root argument now honors fs_dav_provider configuration for custom filesystem providers. 4.3.1 · Mar 2024 · source · release history
  • Adds fs_dav_provider.shadow_map to blend in a favicon when context is opened inline. 4.3.0 · Sep 2023 · source · release history
  • Adds quota-used-bytes and quota-available-bytes collection properties (RFC4331) for disk space quotas. 4.2.0 · Feb 2023 · source · release history
  • Enables sending ETags in PUT response headers v2.4.0 · May 2018 · source · release history
  • Enable setting custom response headers via configuration v2.3.0 · Apr 2018 · source · release history
  • Exposes _DAVResource.finalizeHeaders(environ, responseHeaders) method for extending header logic v2.1.0 · Nov 2016 · source · release history

docs

  • wsgidav.dav_provider.DAVCollection.finalize_headers DAVCollection. finalize_headers ( environ response_headers ) Perform custom operations on the response headers. This gets called before the response is started. It enables adding additional headers or modifying the default ones. seen Oct 2026 · source
  • wsgidav.dav_provider.DAVCollection.get_content_length DAVCollection. get_content_length ( ) → int | None [source] Contains the Content-Length header returned by a GET without accept headers. seen Oct 2026 · source
  • wsgidav.dav_provider.DAVCollection.get_content DAVCollection. get_content ( ) Open content as a stream for reading. Returns a file-like object / stream containing the contents of the resource specified. The calling application will close() the stream. This method MUST be implemented by all providers. seen Oct 2026 · source
  • wsgidav.dav_provider.DAVCollection.get_available_bytes DAVCollection. get_available_bytes ( ) → int | None Return available bytes of the DAV collection. See http://www.webdav.org/specs/rfc4331.html#quota-available-bytes This method COULD be implemented for collection resources. seen Oct 2026 · source
  • wsgidav.dav_provider.DAVCollection.get_content_type DAVCollection. get_content_type ( ) → str | None [source] Contains the Content-Type header returned by a GET without accept headers. This getcontenttype property MUST be defined on any DAV compliant resource that returns the Content-Type header in response to a GET. seen Oct 2026 · source

example

  • Configure a shadow map to add a favicon via YAML. fs_dav_provider: shadow_map: '/path/to/favicon.ico' 4.3.0 · Sep 2023 · source
  • Start wsgidav using a JSON configuration file with a home-directory root path. wsgidav --config wsgidav.json --root '~/shares/data' v2.4.0 · May 2018 · source
Domain controller configuration verified Allows quick configuration of a domain controller via a command-line flag when no config file is present. 9 releases · 6 other sources · first seen Aug 2014

Also counts toward: Command-line interface

release 9 total

  • Each Domain Controller now has its own config section (e.g. simple_dc.user_mapping for SimpleDomainController) instead of top-level options v3.0.0 · Mar 2019 · source · release history
  • Adds command line option --auth for quick-configuration of Domain Controllers v3.0.0 · Mar 2019 · source · release history
  • dir_browser.enabled removed; modify middleware_stack instead v3.0.0 · Mar 2019 · source · release history
  • SimpleDomainController no longer allows anonymous access by default; requires explicit configuration in the new per-Domain Controller config section v3.0.0 · Mar 2019 · source · release history
  • SSL paths are evaluated relative to the config file when a config file is present v3.0.0 · Mar 2019 · source · release history
  • MS provider options ms_sharepoint_plugin and ms_sharepoint_urls removed; use dir_browser.ms_sharepoint_support instead v3.0.0 · Mar 2019 · source · release history

docs

  • A generic, extendable WebDAV server written in Python and based on WSGI, supporting SSL and multiple authentication methods.

command line

  • --auth — quick configuration of a domain controller when no config file is used v3.0.0a7 · Dec 2018 · command-line history

example

  • Configure the WebDAV server's listening address via config file instead of command-line arguments hostname = 'localhost' Port = 8080 [webdav] 1.0.0 · Aug 2014 · source
  • List all available options wsgidav --help
  • Start server with PAM authentication wsgidav --host=0.0.0.0 --port=8080 --root=/tmp --auth=pam-login
  • Start anonymous WebDAV server on port 80 wsgidav --host=0.0.0.0 --port=80 --root=/tmp --auth=anonymous
Custom WSGI server configuration shipped Allows overriding the default web server setup using custom WSGI server and arguments. 5 releases · 2 other sources · first seen Oct 2016

Also counts toward: Command-line interface

release

  • Drop Python 2 support 4.0.0 · Jan 2022 · source · release history
  • Configurable middleware stack: entries can now be strings or dicts evaluated to import and instantiate middleware classes in YAML and JSON config files v3.0.0 · Mar 2019 · source · release history
  • Adds CLI option --server=gevent to run the server using gevent (requires separate installation) v3.0.0 · Mar 2019 · source · release history
  • Adds --ssl-adapter CLI argument to configure SSL handling for the Cheroot server (defaults to builtin) v2.2.1 · Feb 2017 · source · release history
  • New server and server_args configuration keys allow custom WSGI server setup. v2.0.0 · Oct 2016 · source · release history

example

  • Run WsgiDAV with gevent async support via the CLI flag. wsgidav --server=gevent v3.0.0 · Mar 2019 · source
  • Run wsgidav using the new default Cheroot backend with OpenSSL support wsgidav --server=cheroot --ssl-adapter=pyopenssl v2.2.1 · Feb 2017 · source
Reverse proxy authentication shipped Enables authentication via a configured trusted HTTP header for use behind reverse proxies. 6 releases · first seen Aug 2016

release

  • Adds dir_browser.htdocs_path configuration option to customize the HTML directory browser content path 3.1.0 · Jan 2021 · source · release history
  • Allows setting a password for the Redis lock storage via configuration 3.1.0 · Jan 2021 · source · release history
  • environ["http_authenticator.realm"] and environ["http_authenticator.user_name"] renamed to environ["wsgidav.auth.realm"] and environ["wsgidav.auth.user_name"] v3.0.0 · Mar 2019 · source · release history
  • acceptDigest renamed to http_authenticator.accept_digest v3.0.0 · Mar 2019 · source · release history
  • Adds PAMDomainController to allow authenticating system users on Linux and macOS via the Pluggable Authentication Module v3.0.0 · Mar 2019 · source · release history
  • trusted_auth_header: allow reverse proxy authentication via a configured header. v1.3.0 · Aug 2016 · source · release history
Redis-backed distributed lock storage shipped Allows the use of Redis as a backend for storing WebDAV distributed locks, including support for configuring authentication credentials. 5 releases · first seen Jan 2021

release

  • The default value for fs_dav_provider.follow_symlinks is now false, changing symlink behavior. 4.3.0 · Sep 2023 · source · release history
  • Adds fs_dav_provider section to options. 4.3.0 · Sep 2023 · source · release history
  • The lock_manager option is renamed to lock_storage 4.0.0 · Jan 2022 · source · release history
  • Allows setting a password for the Redis lock storage via configuration 3.1.0 · Jan 2021 · source · release history
  • Adds LockStorageRedis class as a sample lock manager implementation 3.1.0 · Jan 2021 · source · release history
Office document integration via WebDAV shipped Enables Microsoft Office clients to open documents directly in edit mode and supports desktop mount integration for WebDAV shares. 4 releases · 1 other source · first seen Aug 2014

release

  • Adds add_header_MS_Author_Via = True setting to enable editing support with Microsoft Office 1.0.0 · Aug 2014 · source · release history
  • Adds msSharepointUrls option to dir_browser to prepend ms-word:ofe|u| protocol prefixes for Office documents 1.0.0 · Aug 2014 · source · release history
  • Adds davmount (RFC 4709) support enabling desktop integration of WebDAV shares 0.5.0 · Aug 2014 · source · release history
  • Adds ms_sharepoint_plugin configuration option under dir_browser to allow opening Microsoft Office documents directly in edit mode 1.1.0 · Aug 2014 · source · release history

example

  • Enable Office document URLs to open directly in MS Office clients when browsing via WebDAV [dir_browser] msSharepointUrls = True add_header_MS_Author_Via = True 1.0.0 · Aug 2014 · source
Per-user chrooting support shipped Provides an internal API to facilitate isolating users in a chroot environment. 2 releases · 1 other source · first seen Aug 2016

release

  • Adds fs_dav_provider.follow_symlinks option to enable symlinks (default: false). 4.3.0 · Sep 2023 · source · release history
  • Per-user chrooting made easier via an internal API change. v1.3.0 · Aug 2016 · source · release history

example

  • Enable symlink following in a YAML config file for the filesystem provider. fs_dav_provider: follow_symlinks: true 4.3.0 · Sep 2023 · source
MongoDB-backed DAV properties storage shipped Provides MongoDB as a backend for storing WebDAV properties, including a sample provider implementation. 3 releases · first seen Aug 2014

release

  • mutable_live_props: enable updating the last modified file/directory timestamps. v1.3.0 · Aug 2016 · source · release history
  • Adds addons.mongo_property_manager for storing DAV properties in MongoDB 0.5.0 · Aug 2014 · source · release history
  • Adds samples.mongo_dav_provider sample provider for MongoDB-backed storage 0.5.0 · Aug 2014 · source · release history
Version info suppression shipped Hides version strings in HTTP responses via a configuration key. 1 release · first seen Mar 2024

release

  • Adds the suppress_version_info configuration key to hide version strings in HTTP responses. 4.3.1 · Mar 2024 · source · release history
Browser auto-launch verified Automatically opens a browser when the tool starts. 1 other source · first seen Dec 2021

command line

Custom HTTP method handlers shipped Supports defining custom response logic for specific HTTP methods such as PUT and GET. 1 release · first seen Nov 2016

release

  • Introduces custom response handlers for HTTP methods like PUT and GET v2.1.0 · Nov 2016 · source · release history
Streaming request support shipped Allows piping PUT request data to external consumers via streaming file-like objects. 1 release · first seen Nov 2016

release

  • Adds addons.stream_tools.FileLikeQueue and StreamingFile helpers to pipe PUT requests to external consumers v2.1.0 · Nov 2016 · source · release history

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for wsgidav, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail wsgidav puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

Show

21 entries

  1. June 20262
  2. May 20261
  3. March 20241
  4. September 20231
  5. February 20231
  6. November 20222
  7. January 20221
  8. January 20211
  9. March 20191
  10. May 20181
  11. April 20181
  12. February 20171
  13. November 20161
  14. October 20161
  15. August 20161
  16. May 20151
  17. August 20143
    Show

    21 entries

    Project health

    Issue, contributor and maintainer activity in mar10/wsgidav, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 6 +2 vs prior 12 months
    2. Maintainers 2 +2 joined · −1 left, last 12 months
    3. Bus factor 1 committers behind half the commits
    4. Community-filed 88% of issues opened, last 12 months
    5. Median time to close 20 days first maintainer reply 4.5 days
    6. Open backlog 3 of 205 issues ever filed
    1. Issues opened / month 2 · 0 communitymaintainers
    2. Open backlog 3
    3. Contributors / month 2
    4. Commits / month 17
    5. Stars 1,233
    Issue themes, last 12 months
    • bugs 75%
    • features 25%

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Libraries its release ships

    What its latest release locks, checked against known advisories.

    None of its release's images build from a lockfile we can read.

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    browse all tools → score card for your toolchain →