DAV credential setup is denied and scoped DAV requests time out #567

Open
opened 2026-10-01 02:42:11 +00:00 by kayg · 1 comment
Owner

During the local API adversarial round for calternal#465, the unchanged scoped WebDAV probe observed:

  • POST /api/v1/auth/app-passwords returned 403 (forbidden); expected 200 for the authenticated owner setup.
  • DAV two-area discovery timed out, then found 0 of 2 area calendars.
  • 3 of 24 concurrent DAV home listings timed out.
  • The later DAV Files credential request and DAV create also timed out.

Reproduce with ADVERSARIAL_API_ONLY=1 tests/adversarial/run.sh; see dav_webdav_probes in tests/adversarial/attack.py. The server stayed alive, but these are non-SLOW findings and need an auth/availability review. The Inspector change does not touch DAV or app-password routes.

During the local API adversarial round for calternal#465, the unchanged scoped WebDAV probe observed: - `POST /api/v1/auth/app-passwords` returned 403 (`forbidden`); expected 200 for the authenticated owner setup. - DAV two-area discovery timed out, then found 0 of 2 area calendars. - 3 of 24 concurrent DAV home listings timed out. - The later DAV Files credential request and DAV create also timed out. Reproduce with `ADVERSARIAL_API_ONLY=1 tests/adversarial/run.sh`; see `dav_webdav_probes` in `tests/adversarial/attack.py`. The server stayed alive, but these are non-SLOW findings and need an auth/availability review. The Inspector change does not touch DAV or app-password routes.
Author
Owner

One local API-only adversarial round against the merged branch reported: DAV Files credential setup: expected 200, got 403, with body {"code":"forbidden","message":"Access denied"}. It also logged SLOW successful responses for DAV app-password setup and initial/incremental sync. The 20-minute round timed out during a later Photos upload campaign. This job did not change DAV authorization.

One local API-only adversarial round against the merged branch reported: DAV Files credential setup: expected 200, got 403, with body {"code":"forbidden","message":"Access denied"}. It also logged SLOW successful responses for DAV app-password setup and initial/incremental sync. The 20-minute round timed out during a later Photos upload campaign. This job did not change DAV authorization.
Sign in to join this conversation.
No labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/calternal#567
No description provided.