Davdroid no longer works with NC

[davdroid]

(I have just omitted various RFC references because “Sorry, new users can only put 2 links in a post.”)

@LukasReschke

DAVdroid sends a request with only the Nextcloud session cookie.
The server sends back a 503 AND the new expected cookies which is HTTP standard compliant behaviour.

DAVdroid should in this case get the new cookies and send them back in the next request. That’s what the HTTP specs say

Yes, that was to be the problem. DAVdroid did not send all cookies, but only some of them.

However, where do specs say that a 503 response is “standard-compliant behavior”? RFC 7231 6.6.4 says:

The 503 (Service Unavailable) status code indicates that the server is currently unable to handle the request due to a temporary overload or scheduled maintenance, which will likely be alleviated after some delay. The server MAY send a Retry-After header field (Section 7.1.3) to suggest an appropriate amount of time for the client to wait before retrying the request.

So, 503 doesn’t seem appropriate. If the behavior of enforcing cookies for stateless WebDAV is really intended (which I find strange), 403 + a textual explanation would be appropriate in my opinion:

The 403 (Forbidden) status code indicates that the server understood the request but refuses to authorize it. […] If authentication credentials were provided in the request, the server considers them insufficient to grant access. The client SHOULD NOT automatically repeat the request with the same credentials. The client MAY repeat the request with new or different credentials. However, a request might be forbidden for reasons unrelated to the credentials.

Also, the whole cookie-forcing behavior seems quite strange to me:

1. It seems to be consensus that CalDAV/CardDAV is not stateful (except when defined so, like for locking operations) and clients don’t have to support cookies.
2. So we only have to look at the case where cookies are basically supported. In this case, Nextcloud insists on all cookies to be sent and refuses requests with 503 if not all cookies are sent. However, RFC 6265 makes quite clear that it’s up to the User-Agent which cookes are stored and which are not. For instance, you might think of a user/browser plugin which blocks certain cookies by name (but not all cookies).

So, in my opinion:

• Cookie support should not be required by Nextcloud CalDAV/CardDAV.
• It can’t be expected that a client accepts and serves all cookies, so cookies should only be used for optional tasks (like Horde uses a session cookie for grouping requests to one “sync session”).
• If Nextcloud does expect clients to accept and serve all cookies, requests should not be refused with 503, but with 403 plus an textual explanation what went wrong.