26

I notice a series lines never seen before on my server access log that runs like this consecutively within the same one second:

PROPFIND /images/flag.jpg HTTP/1.1  405 493 265    511    - LibreOffice
HEAD /images/flag.jpg HTTP/1.1      200 164 -      229    - LibreOffice
GET /images/flag.jpg HTTP/1.1       200 186 338166 338395 - LibreOffice

It appears that copying images from the website to a LibreOffice document will cause these queries to be triggered. I found PROPFIND being mentioned on a Microsoft website, but still do not understand its usage and why not just use a single GET instead?

Improve this question

1 Answer 1

Reset to default
19

From Wikipedia:

Web Distributed Authoring and Versioning (WebDAV) is an extension of the Hypertext Transfer Protocol (HTTP) that facilitates collaboration between users in editing and managing documents and files stored on World Wide Web servers.

PROPFIND — used to retrieve properties, stored as XML, from a web resource. It is also overloaded to allow one to retrieve the collection structure (a.k.a. directory hierarchy) of a remote system.

GET actually retrieves the resource. HEAD is similar to GET except that the message body is not returned. That is, it gets the file header information and not the entire resource.

It appears that PROPFIND differs from HEAD in that properties data stored as XML is returned in the message body (of the packet) rather than attempting to return the entire resource. OpenOffice and Libre documents contain XML as compared to the proprietary format that Microsoft and others use.

It is likely that using Libre with images linked from your website, may be triggering this.

Improve this answer
3
  • Can you elaborate on the "properties" and "structure" that PROPFIND is supposed to get out of the HTTP request PROPFIND /images/flag.jpg?
    – Question Overflow
    Mar 8, 2014 at 6:03
  • I have no idea. Sorry. Clearly the JPG file is binary format. I am not suggesting that XML is in your image file. However, if a PROPFIND fails, a 404 is returned. Perhaps LibreOffice is blanket testing resources for XML header information regardless of file type.
    – closetnoc
    Mar 8, 2014 at 6:12
  • One way to test if it is LibreOffice is to create a new simple file with a resource on your website (preferably an image) that is new and has a unique name so that if you get a request for that file, you know where it came from. Then you know that these requests are not malicious. Otherwise, check the IP (or domain name) to make sure it is not within your network or someone you know. If the request is coming from an unknown location, then block the IP address (or domain name) and see who complains if at all. That's an old SA trick.
    – closetnoc
    Mar 8, 2014 at 6:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.