GL-BE3600 webdav_httpd: PROPFIND returns 200 instead of 207, breaks Zotero 8/9 sync

Router
1

Bug: webdav_httpd/1.0.1 returns HTTP 200 instead of 207 for PROPFIND requests, breaking Zotero 8/9 WebDAV sync

Device: GL-BE3600 (Slate 7)
Firmware: v4.8.3
Impact: Zotero WebDAV sync is completely broken for anyone on Zotero 8 or 9 using the router's built-in WebDAV server. Worked fine on Zotero 7.

Root Cause

The router's webdav_httpd/1.0.1 is returning HTTP 200 in response to a PROPFIND request instead of the required HTTP 207 Multi-Status. This is confirmed non-compliant with RFC 4918 §9.1.

The likely trigger is a change in how Zotero 8+ (and the underlying Mozilla networking library) handles preemptive HTTP authentication — the PROPFIND may be going out without credentials first, and the server responds with 200 anonymously instead of 401, meaning Zotero never gets a proper authenticated 207 response.

Additionally, the server appears to handle PROPFIND requests differently depending on the XML namespace syntax in the request body:

  • Prefixed namespace (old style) → correctly returns 207 Multi-Status :white_check_mark:
  • Default namespace (new style, used by Zotero 8+) → incorrectly returns 200 OK :cross_mark:

Reproduction

This returns the correct 207:

curl -v -k -X PROPFIND https://192.168.8.1:6008/disk1_part1/zotero/ \
  -u user:pass -H "Depth: 0" -H "Content-Type: text/xml" \
  -d "<?xml version='1.0'?><D:propfind xmlns:D='DAV:'><D:prop><D:resourcetype/></D:prop></D:propfind>"

This returns the wrong 200 (Zotero's exact request format):

curl -v -k -X PROPFIND https://192.168.8.1:6008/disk1_part1/zotero/ \
  -u user:pass -H "Depth: 0" -H "Content-Type: text/xml" \
  -d "<propfind xmlns='DAV:'><prop><getcontentlength/></prop></propfind>"

References

Zotero forum thread: WebDAV Syncing in Zotero 9 D1340576435 - Zotero Forums

Zotero lead developer (dstillman): *"A WebDAV server has to return 207 for a PROPFIND request, not 200. The change here likely has to do with how Zotero (and the underlying Mozilla platform) handles preemptive HTTP authentication, but the server should be returning 401 to require authentication, not a 200."

RFC 4918 §9.1 requires PROPFIND to always return 207 Multi-Status.

Please update webdav_httpd to correctly handle PROPFIND requests and return 207. Happy to provide additional logs if needed.

2

Hi

Not entirely sure whether my understanding is correct.

But it seems that the issue may be related to the request data in Zotero 8/9 not starting with an XML text declaration?

<?xml version='1.0'?>

In the example for PROPFIND requests in RFC 4918 §9.1.3 that you referenced:

image
image786×400 29.8 KB

Perhaps there has been some related update here — do any new RFC documents mention that the XML text declaration can be omitted?

4

Hello, thanks for looking into this. I’ve gone ahead and started a thread on Zotero.
I think you’re right specified in section 2.8 here: Extensible Markup Language (XML) 1.0 (Fifth Edition) #sec-prolog-dtd, I’ll communicate that to the thread. Regardless, I think it’s an XML parser fix so it should be easy on both sides once we’ve reached a conclusion.