Operating system and version (e.g., Ubuntu 24.04):
Synology DSM 7.3.2-86009 Update 3
Web server and version (e.g, Apache 2.4.25):
apache
Reverse proxy and version _(e.g. nginx 1.27.2)
--
PHP version (e.g, 8.3):
--
Is this the first time you’ve seen this error? (Yes / No):
Yes
When did this problem seem to first start?
Today
Installation method (e.g. AlO, NCP, Bare Metal/Archive, etc.)
Container Manager in Synology NAS
Are you using CloudfIare, mod_security, or similar? (Yes / No)
No
Summary of the issue you are facing:
This is all about running Nextcloud 33 in Container Manager in Synology NAS.
Since we want to force web only working in Nextcloud/OnlyOffice for privacy reasons, I need to prevent users who want to use webdav. No one must have the option to sync files to their devices.
Yes, they are still able to download from web portal, but that is okay.
I am tired of searching for a possible way to turn off or block webdav.
In synology drive this was one button, but here I can’t find any way to do it.
Tried to edit .htaccess file, but that didn’t work.
Tried Flow, but still could use the Nextcloud app on phone.
Unfortunately there is no simple out of-the-box-solution here. The Nextcloud web UI itself is a WebDAV client – the browser’s file manager makes PROPFIND and REPORT requests against /remote.php/dav/files/ to list directories and retrieve file metadata. Simply blocking /remote.php/dav/ would break the web interface entirely.
The only technical difference between a browser session and a sync client is the authentication method: the browser uses a session cookie, while desktop and mobile sync clients authenticate via Basic Auth or an app token (including after an OAuth2/Login Flow v2 grant).
A proper solution would require something like ModSecurity, which can inspect request headers and allow or deny based on the presence of a valid session cookie. That would correctly distinguish web UI access from sync client access. But setting that up on Synology DSM is far beyond what can be explained in a forum post.
I am not aware of a simpler built-in solution for this in Nextcloud.
How I would approach this:
a minimal custom Nextcloud app (~80 lines of PHP, no database, no frontend) that listens to Nextcloud’s internal AppPasswordCreatedEvent and immediately invalidates any newly created app token. Browser sessions are unaffected because they use a different token type (TEMPORARY_TOKEN) that does not trigger this event.
The catch: the event is part of Nextcloud’s internal (non-public) API, which means it could break on a major Nextcloud update. For a homelab setup where you control the update schedule, that is manageable.
I have not tested this, so no guarantees – but it should be straightforward to implement and deploy.
I don’t really get the reason you are trying to prevent client access..
but just to make you aware - the solution you posted doesn’t exactly prevent access to WebDAV it simply blocks some user agents. It is more like “security by obscurity” which might be good enough for your audience and use case but you should be aware of limitations.. Given somebody uses random WebDAV client or curl/wget he still can access WebDAV (and customize UA string).
It is not preventing client access. It is limiting access to web only.
The reason is that we don’t want any privacy sensitive data on our devices in case of theft or whatever. When we are able to connect via webdav, we are basically allowing our devices to store data in our phones and that’s taboo.
So for security reasons we only have access to our data with VPN connection (through synolog vpn server). Even when we are in local network, we have forced VPN to access. On top of that we work only web based.
I appreciate constructive discussions. I see your reasons but IMO blocking clients is the wrong approach (see reasons above). Additionally - as long people have the chance to download files through the web interface missing client only makes the work harder for the user but doesn’t improve security.. and maybe create some blind spots when you build protection of a wrong assumptions. I think you would better address the challenges if you you protect the whole endpoint - strong authentication, encrypted disks..
I understand your way, but the data in rest is already safe. It backups encrypted to different encrypted locations every night. I did everything for this. Even when it is physically stolen, it is encrypted. Data in transfer is safe through VPN.
For me this is enough.
But the problem is: I can’t control our user (15 ppl) devices, so I don’t trust them.
Yes, for some reasons, some data will be downloaded on our devices for easy of use maybe, one pdf or something, but I know that and that is not an issue for us. The idea is to not be able to sync or store all data on our devices.
Therefore I do everything I can to make it safe when something happens to a device of one of ours.
So, only strong authentication is not enough.
In Synology Drive, this was easy to manage. One button for the device apps block and one button for webdav block.
Request user agent: The user agent of the users browser or client. Nextcloud desktop, Android and iOS clients are available as preconfigured options.
But I don’t use file access control myself, so I can’t say how well it works. If I were you, I’d probably go for the web server configuration described by @Suqie8e00 as well.
I tried many times file access control. It really doesn’t work.
Did make the rules one on one by given instructions. Does not work, but that is not the only thing that doesn’t work..
Since my python scripts do their job to make simple hyperlinks in .xlsx files in NC, but NC/OO can’t handle, because everything goes through one webdav port, it just can’t manage the scripts.
I only switched to NC because my python scripts would make a difference, but in the end it is not.
There this ends for me. Too much to handle, which I can’t.
At the end of the day, though, it’s actually quite simple if you keep the following in mind:
The only reliable way to prevent Nextcloud data from ending up on users’ personal devices is to prevent personal devices from accessing the network where Nextcloud is hosted in the first place.
You mentioned that your Nextcloud is already behind a VPN. So why are users able to connect to it using their personal devices?
In larger companies, users are typically provided with locked-down company laptops where they cannot freely install or configure software. For mobile devices, users usually either have to install the company’s MDM (Mobile Device Management) solution — which manages VPN access, authentication, company apps, device hardening, monitoring, remote wipe capabilities, etc. — or they simply don’t get mobile access.
Anything else is mostly just tinkering and, depending on your country and industry, may very well not comply with applicable regulations or insurance requirements. I’m not sure your Python scripts — or most of the other things suggested in this thread — would really hold up as “adequate security measures” in front of an insurance company or, in the worst case, in court.
