[Bug]: Public WebDAV share returns 401 to unauthenticated OPTIONS without WWW-Authenticate

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

Password-protected public WebDAV shares return 401 Unauthorized to an unauthenticated OPTIONS request, but without a WWW-Authenticate header.

This breaks challenge-based WebDAV clients such as davfs2, even though the same endpoint works correctly when Authorization is sent explicitly.

Actual behavior

• unauthenticated OPTIONS -> 401 Unauthorized
• no WWW-Authenticate header in the response
• authenticated OPTIONS -> 200 OK
• authenticated PROPFIND -> 207 Multi-Status

Steps to reproduce

1. Create a password-protected public folder share.

2. Use its public WebDAV endpoint:

   https://<host>/public.php/dav/files/<token>/

3. Run:

Unauthenticated OPTIONS:

curl --http1.1 -v -i -X OPTIONS \
'https://<host>/public.php/dav/files/<token>/'

• unauthenticated OPTIONS -> 401 Unauthorized
• no WWW-Authenticate header in the response

Authenticated OPTIONS:

curl --http1.1 -v -i \
-H 'Authorization: Basic <base64(anonymous:share_password)>' \
-X OPTIONS \
'https://<host>/public.php/dav/files/<token>/'

• authenticated OPTIONS -> 200 OK

Authenticated PROPFIND:

curl --http1.1 -v -i \
-u 'anonymous:<share_password>' \
-X PROPFIND -H 'Depth: 0' \
'https://<host>/public.php/dav/files/<token>/'

• authenticated PROPFIND -> 207 Multi-Status

Expected behavior

Unauthenticated access to a protected public WebDAV share should return:

• 401 Unauthorized with WWW-Authenticate

so that clients using the standard HTTP auth challenge flow can continue with authentication.

Nextcloud Server version

33

Operating system

Other

PHP engine version

None

Web server

None

Database engine version

None

Is this bug present after an update or on a fresh install?

Fresh Nextcloud Server install

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

List of activated Apps

Nextcloud Signing status

Nextcloud Logs

Additional info

No response