Request Method: MKCOL - 405 Method not allowed

[alinmear]

Steps to reproduce

1. Drag'n'Drop Folder with multiple Subfolders and Files for Upload

Expected behaviour

The Folder gets uploaded without problems.

Actual behaviour

After a short period of time the client hangs, consuming alot of cpu and cycling

Server configuration

Operating system: Red Hat Enterprise Linux Server 7.7 (Maipo)

Web server: Apache/2.4.41 (IUS)

Database: mysql Ver 15.1 Distrib 10.1.41-MariaDB, for Linux (x86_64) using readline 5.1

PHP version: PHP 7.2.21

Nextcloud version: 16.0.4

Updated from an older Nextcloud/ownCloud or fresh install: fresh install

Where did you install Nextcloud from: https://github.com/nextcloud/server/archive/16.0.4.zip

Signing status:

Signing status

``` No errors have been found. ```

List of activated apps:

App list

``` Enabled: - activity: 2.9.1 - admin_audit: 1.6.0 - cloud_federation_api: 0.2.0 - comments: 1.6.0 - dav: 1.9.2 - federatedfilesharing: 1.6.0 - files: 1.11.0 - files_pdfviewer: 1.5.0 - files_retention: 1.5.1 - files_rightclick: 0.13.0 - files_sharing: 1.8.0 - files_trackdownloads: 1.5.0 - files_trashbin: 1.6.0 - files_versions: 1.9.0 - groupfolders: 4.0.5 - jsloader: 1.0.2 - logreader: 2.1.0 - lookup_server_connector: 1.4.0 - notifications: 2.4.1 - oauth2: 1.4.2 - password_policy: 1.6.0 - privacy: 1.0.0 - provisioning_api: 1.6.0 - recommendations: 0.4.0 - serverinfo: 1.6.0 - sharebymail: 1.6.0 - systemtags: 1.6.0 - theming: 1.7.0 - theming_customcss: 1.3.0 - twofactor_backupcodes: 1.5.0 - user_ldap: 1.6.0 - user_saml: 2.3.1 - workflowengine: 1.6.0 Disabled: - accessibility - encryption - federation - files_external - files_texteditor - files_videoplayer - firstrunwizard - gallery - nextcloud_announcements - support - survey_client - updatenotification - viewer ```

Nextcloud configuration:

Config report

``` { "system": { "passwordsalt": "***REMOVED SENSITIVE VALUE***", "secret": "***REMOVED SENSITIVE VALUE***", "trusted_domains": [ "localhost", "nc.mydomain.int.local", "nc.mydomain.com" ], "datadirectory": "***REMOVED SENSITIVE VALUE***", "dbtype": "mysql", "version": "16.0.3.0", "overwrite.cli.url": "http:\/\/localhost", "dbname": "***REMOVED SENSITIVE VALUE***", "dbhost": "***REMOVED SENSITIVE VALUE***", "dbport": "", "dbtableprefix": "oc_", "mysql.utf8mb4": true, "dbuser": "***REMOVED SENSITIVE VALUE***", "dbpassword": "***REMOVED SENSITIVE VALUE***", "installed": true, "instanceid": "***REMOVED SENSITIVE VALUE***", "proxy": "http:\/\/proxy.mydomain.com:8080", "maintenance": false, "ldapIgnoreNamingRules": false, "ldapProviderFactory": "OCA\\User_LDAP\\LDAPProviderFactory", "log_type": "syslog", "logfile=": "", "redis": { "host": "***REMOVED SENSITIVE VALUE***", "port": "6379" }, "memcache.locking": "\\OC\\Memcache\\Redis", "memcache.local": "\\OC\\Memcache\\Redis", "filelocking.enabled": false, "mail_from_address": "***REMOVED SENSITIVE VALUE***", "mail_domain": "***REMOVED SENSITIVE VALUE***", "mail_smtphost": "***REMOVED SENSITIVE VALUE***", "default_language": "de", "default_locale": "de_DE", "knowledgebaseenabled": false, "check_data_directory_permissions": false, "trashbin_retention_obligation": "5,5" } } ```

Are you using external storage, if yes which one: nfs

Are you using encryption: no

Are you using an external user-backend, if yes which one: LDAP

LDAP configuration (delete this part if not used)

``` ```

Client configuration

Browser: Chrome Version 76.0.3809.100 (Offizieller Build) (32-Bit), FF 68.0.1esr (32-Bit)

Operating system: Win10

Logs

Web server error log

Web server error log

``` Insert your webserver log here ```

Nextcloud log (data/nextcloud.log)

Nextcloud log

``` ```

Browser log

Browser log

``` NonUnicode Normal Main.js libs Regular getstoragestats.php reveal.js Regular Regular 3.7.0 vscode-reveal Main.js getstoragestats.php?dir=%2F plugin Main.js libs Main.js math reveal.js jax 3.7.0 output plugin HTML-CSS math fonts jax Neo-Euler getstoragestats.php?dir=%2F Request URL: https://nc.mydomain.com/remote.php/dav/files/userid/vscode-reveal/libs/reveal.js/3.7.0/plugin/math Request Method: MKCOL Status Code: 405 Method Not Allowed Remote Address: 194.8.61.81:443 Referrer Policy: no-referrer Allow: OPTIONS, GET, HEAD, DELETE, PROPFIND, PUT, PROPPATCH, COPY, MOVE, REPORT Cache-Control: no-store, no-cache, must-revalidate Connection: Keep-Alive Content-Length: 247 Content-Security-Policy: default-src 'none'; Content-Type: application/xml; charset=utf-8 Date: Tue, 23 Jul 2019 05:56:31 GMT Expires: Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive: timeout=5, max=15 Pragma: no-cache Referrer-Policy: no-referrer Server: Apache/2.4.39 Strict-Transport-Security: max-age=31536000 Strict-Transport-Security: max-age=31536000 Vary: Cookie X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-Robots-Tag: none X-XSS-Protection: 1; mode=block Accept: */* Accept-Encoding: gzip, deflate, br Accept-Language: de-DE,de;q=0.9,en-US;q=0.8,en;q=0.7 Connection: keep-alive Cookie: __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true; ocqmladiy7z7=66jkutsoltm7a65ure008sc6p9; oc_sessionPassphrase=Cso2XqYDuLD5btD4jS%2BDbwqNAfeJdOXJIj4d4XaQwZbRvRDM4VxOOwSdvAZZ1hbdQMymCn0UOTucxbAXtk9jVeiuzEOukvKwXJTLIn%2Fv2JnaVwUWMCSFGapoKTM2sZyM Host: nc.mydomain.com Origin: https://nc.mydomain.com requesttoken: gzjzHXJ4lsZmO5tgH1NczyDYpEFCI0EU6R/tX5XLL+g=:y0mRKBdIp6FNfsI2eRZkrmv31zg3WzFFnjSZbaGSFoE= User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36 X-Requested-With: XMLHttpRequest ``` 

[kesselb]

Anything in the nextcloud log?

[alinmear]

@kesselb nothing relevant and no errors. Behaviour can be reproduced on another instance too. I downloaded the vscode reveal plugin from https://github.com/evilz/vscode-reveal/archive/Version-3.4.0.zip; unzipped it and uploaded it via drag'n'drop.

[solracsf]

Experiencing same here, nothing on Nextcloud logs but on Nginx logs:

176.177.xxx.xxx - -  "MKCOL /remote.php/dav/files/user/TEST%202/folder/oakes-grotesk-complete-family-webfont-lite HTTP/1.1" 405 
176.177.xxx.xxx - -  "MKCOL /remote.php/dav/files/user/TEST%202/folder/oakes-grotesk-complete-family-webfont-lite/oakes-grotesk-semi-bold HTTP/1.1" 405 
176.177.xxx.xxx - -  "MKCOL /remote.php/dav/files/user/TEST%202/folder/oakes-grotesk-complete-family-webfont-lite/oakes-grotesk-semi-bold/webfonts HTTP/1.1" 405 
176.177.xxx.xxx - -  "MKCOL /remote.php/dav/files/user/TEST%202/folder HTTP/1.1" 405 
176.177.xxx.xxx - -  "MKCOL /remote.php/dav/files/user/TEST%202/folder/oakes-grotesk-complete-family-webfont-lite HTTP/1.1" 405 
176.177.xxx.xxx - -  "MKCOL /remote.php/dav/files/user/TEST%202/folder/oakes-grotesk-complete-family-webfont-lite/oakes-grotesk-semi-bold-italic HTTP/1.1" 405 
176.177.xxx.xxx - -  "MKCOL /remote.php/dav/files/user/TEST%202/folder HTTP/1.1" 405 
176.177.xxx.xxx - -  "MKCOL /remote.php/dav/files/user/TEST%202/folder/oakes-grotesk-complete-family-webfont-lite HTTP/1.1" 405 
176.177.xxx.xxx - -  "MKCOL /remote.php/dav/files/user/TEST%202/folder/oakes-grotesk-complete-family-webfont-lite/oakes-grotesk-semi-bold-italic HTTP/1.1" 405 
176.177.xxx.xxx - -  "MKCOL /remote.php/dav/files/user/TEST%202/folder/oakes-grotesk-complete-family-webfont-lite/oakes-grotesk-semi-bold-italic/webfonts HTTP/1.1" 405 

[simonspa]

Same issue here. I also observe a hanging of the client, a very high CPU load on the server, and ultimately a failed upload. This only happens with very specific files (or file types? Some XML files seem problematic) but for both web interface and Android client alike.

The request looks like this:

MKCOL /remote.php/dav/uploads/<user>/e4567724630610c8db3f14f9063d752d HTTP/1.1
Authorization: Basic <hash>
Host: cloud.domain.tld
User-Agent: Mozilla/5.0 (Android) Nextcloud-android/3.9.2
Cookie: oc0e7rzi20xo=<cookie>;oc_sessionPassphrase=<passphrase>; __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true; oc0e7rzi20xo=<cookie>
Content-Length: 0

The response from Nextcloud is:

HTTP/1.1 405
Content-Security-Policy: default-src 'none';
Expires: Thu, 19 Nov 1981 08:52:00 GMT
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Cache-Control: no-store, no-cache, must-revalidate
Allow: OPTIONS, GET, HEAD, DELETE, PROPFIND, PUT, PROPPATCH, COPY, MOVE, REPORT
Connection: keep-alive
Content-Type: application/xml; charset=utf-8
Date: Tue, 24 Dec 2019 16:33:33 GMT
Server: nginx
X-Frame-Options: SAMEORIGIN

Somehow MKCOL is not among the allows methods reported by the server here?

[simonspa]

Here are my installation details (17.0.2):

{
    "system": {
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "cloud.domain.tld"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "data-fingerprint": "58897020af7835d5d5eebe9f70033c28",
        "dbtype": "mysql",
        "version": "17.0.2.1",
        "overwrite.cli.url": "https:\/\/cloud.domain.tld",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "3306",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "htaccess.RewriteBase": "\/",
        "mail_smtpsecure": "ssl",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "465",
        "logtimezone": "Europe\/Berlin",
        "log_rotate_size": "104857600",
        "mail_smtpauthtype": "LOGIN",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "password": "***REMOVED SENSITIVE VALUE***",
            "port": 0,
            "timeout": 0
        },
        "memcache.local": "\\OC\\Memcache\\APCu",
        "maintenance": false,
        "preview_max_y": 2048,
        "preview_max_x": 2048,
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "mail_smtpauth": 1,
        "simpleSignUpLink.shown": false,
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "knowledgebaseenabled": false,
        "loglevel": 2,
        "filelocking.enabled": "true",
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "updater.release.channel": "stable",
        "activity_expire_days": 90,
        "mail_smtpmode": "smtp",
        "theme": ""
    }
}

[kesselb]

Are you able to reproduce this with a test instance? Please describe how to reproduce this issue.

$ curl -I --user admin:admin -X OPTIONS https://nextcloud.test/remote.php/dav
HTTP/2 200 
server: nginx/1.15.8
date: Sat, 28 Dec 2019 22:20:41 GMT
content-type: text/html; charset=UTF-8
content-length: 0
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
content-security-policy: default-src 'none';
allow: OPTIONS, GET, HEAD, DELETE, PROPFIND, PUT, PROPPATCH, COPY, MOVE, REPORT, SEARCH
dav: 1, 3, extended-mkcol, access-control, calendarserver-principal-property-search, nc-calendar-search, nc-enable-birthday-calendar
ms-author-via: DAV
accept-ranges: bytes
dasl: <DAV:basicsearch>
referrer-policy: no-referrer
x-content-type-options: nosniff
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-robots-tag: none
x-xss-protection: 1; mode=block

A options request to example.com/remote.php/dav will produce a similar output. If your output is very different (e.g. dav: 1, 3, extended-mkcol, is missing) the webserver (or a module / security list / you name it) is probably interfering the request.

[simonspa]

Running the curl command you provided against my instance returns the same methods allowed as your example:

HTTP/2 200 
server: nginx
date: Mon, 30 Dec 2019 16:11:59 GMT
content-type: text/html; charset=UTF-8
content-length: 0
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
<cookies>
content-security-policy: default-src 'none';
allow: OPTIONS, GET, HEAD, DELETE, PROPFIND, PUT, PROPPATCH, COPY, MOVE, REPORT, SEARCH
dav: 1, 3, extended-mkcol, access-control, calendarserver-principal-property-search, nc-calendar-search, nc-enable-birthday-calendar
ms-author-via: DAV
accept-ranges: bytes
dasl: <DAV:basicsearch>
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-robots-tag: none
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
referrer-policy: no-referrer

The test instance creation currently does not work ("an error occurred during execution"), I will try again later and report if and how to reproduce.

[ghost]

This issue has been automatically marked as stale because it has not had recent activity and seems to be missing some essential information. It will be closed if no further activity occurs. Thank you for your contributions.

[ghost]

This issue has been automatically marked as stale because it has not had recent activity and seems to be missing some essential information. It will be closed if no further activity occurs. Thank you for your contributions.

[FelixJongleur42]

Maybe this is some issue of a proxy that is involved?

[anthosz]

We have the same issue when directory already exist... 201 if not exist... 405 if exist..

[scriptsagency]

One reason for 405 MKCOL message present in browser console is the fact that the folder already exists: in the code check
3rdparty/sabre/dav/lib/DAV/Server.php:1180

`// Making sure the child does not already exist try { $parent->getChild($newName);

        // If we got here.. it means there's already a node on that url, and we need to throw a 405
        throw new Exception\MethodNotAllowed('The resource you tried to create already exists');

    } catch (Exception\NotFound $e) {
        // NotFound is the expected behavior.
    }`

Why a lot of duplicate requests are being made when a folder tree is being uploaded is a different story, but the message is only confusing and not user friendly, in the back the upload will work .

This is only one potential case for this error message, multiple reasons for getting 405 can be present including MKCOL not being allowed.

[FelixJongleur42]

but the message is only confusing and not user friendly, in the back the upload will work .

Well not quite! The sync client also runs into this problem and it leads to the problem that the sync is being delayed (for retry) which is very annoying. I don‘t understand why this issue is already closed if so many have trouble with it.

[FelixJongleur42]

multiple reasons for getting 405 can be present including MKCOL not being allowed.

Well maybe 409 would be the better response code if the resource already exists. That way a client could differentiate better between 409 not allowed and 405 resource already exists.

[solracsf]

This is still a thing in v27.

Same output as https://github.com/nextcloud/server/issues/17064#issuecomment-560728147 when a folder containing multiple (hundreds) sub-folders and files is uploaded trough the browser using drang & drop (this is reproductible).

Bulk-upload is disabled in the config.php file.

[blabno]

For me the root cause was misalignment of client_max_body_size and client_body_buffer_size on nginx running as part of nextcloud docker cluster and another nginx acting as reverse proxy.

Now I stick to following values and things seem to work fine:

client_max_body_size 512M;
client_body_buffer_size 512k;

[FelixJongleur42]

For me the root cause was misalignment of client_max_body_size and client_body_buffer_size on nginx running as part of nextcloud docker cluster and another nginx acting as reverse proxy.

Could you elaborate on what you mean by "misalignment"? Between client_max_body_size and client_body_buffer_size or between the two reverse proxies?

[blabno]

For me the root cause was misalignment of client_max_body_size and client_body_buffer_size on nginx running as part of nextcloud docker cluster and another nginx acting as reverse proxy.

Could you elaborate on what you mean by "misalignment"? Between client_max_body_size and client_body_buffer_size or between the two reverse proxies?

My reverse proxy had client_max_body_size set to 10G, while nextcould nginx had client_max_body_size set to 512M. The client_body_buffer_size was also different on both services.

My setup is similar to https://github.com/nextcloud/docker/blob/master/.examples/docker-compose/with-nginx-proxy/postgres/fpm/docker-compose.yml plus I have additional nginx acting as reverse proxy.

[skjnldsv]

@solracsf you can still experience this on 28 and above?

[solracsf]

Have not seen this in a while 👍