E019: HTTP status 400. Failed MOVE request: Bad Request - Nginx misconfiguration

[ottoosworth]

Which version of floccus are you using?

5.10.2

How many bookmarks do you have, roughly?

1000 but also tested with 1

Are you using other means to sync bookmarks in parallel to floccus?

No

Sync method

WebDAV

Which browser are you using? In case you are using the phone App, specify the Android or iOS version and device please.

Brave 1.92.143 (Windows 10) and Mobile App (Android 9 - Galaxy s8) - Extension/App version 5.10.2

Which version of Nextcloud Bookmarks are you using? (if relevant)

No response

Which version of Nextcloud? (if relevant)

No response

What kind of WebDAV server are you using? (if relevant)

location /webdav {
      alias /home/wasabi9805;

      client_body_temp_path /home/wasabi9805/webdav;
      dav_methods PUT DELETE MKCOL COPY MOVE;
      dav_ext_methods PROPFIND OPTIONS;
      create_full_put_path on;

      # doesnt work with this ???
      ##dav_ext_lock zone=foo;
      ## not needed ???
          ##dav_access    user:rw group:rw all:r;

      # enable creating directories without trailing slash
      #set $x $uri$request_method;
      #if ($x ~ [^/]MKCOL$) {
      #    rewrite ^(.*)$ $1/;
      #}

      # Basic authentication setup
      auth_basic "Webdav Restricted Access";
      auth_basic_user_file    /home/wasabi9805/www/.htpasswd;

      # Deny all access unless authenticated
      satisfy all;
      allow all;  # This allows all authenticated users
      deny all;   # This denies all other users
}

Describe the Bug

Context: I keep 1 device as the primary that I make changes to and have it sync across the rest of the devices.

The extension in brave is set to " Always upload local changes and undo changes from other browsers"
On my phone the app is set to "Always undo local changes and download changes"

For the past three weeks sync has been failing to upload changes made to brave and I tried looking into it by making various changes on the browser side, I contacted my webhost and they sited "CVE-2026-27654" and made some changes I tried multiple different settings like "Allow redirects in Server URL" and "Send client credentials" and even redoing the whole setup.

Finally I switched roles of the extension and app:
The extension in brave is set to "Always undo local changes and download changes"
On my phone the app is set to "Always upload local changes and undo changes from other browsers"

For both i used the same config just switched the settings, and tried to delete a bookmark.
With this setup i was able to upload the changes on phone and it sync successfully with extension.

I tried reversing the roles again and get the same error on the extension.

At this point I'm not sure if the app has the recent changes mentioned in "#2302" or only the extension does or if it's the server that's the problem

floccus-5.10.2-2026-07-24-redacted (1).log

Expected Behavior

Setting the browser extension to "Always upload local changes" should function identically to setting the mobile app to the same rule

To Reproduce

Use Webdav with given config:
Set sync strategy to "Always upload local changes and undo changes from other browsers".
Make a local change in Brave (e.g., delete or add a bookmark).
Trigger a manual sync in the Brave extension.
Result: Sync fails with E019: HTTP status 400. Failed MOVE request: Bad Request.

Swap Roles (Control Test):
Change Brave extension strategy to "Always undo local changes"
Change Mobile App strategy to "Always upload local changes"
Make a change on the mobile app and trigger sync.
Result: Sync completes successfully both ways without errors.

Debug log provided

• I have provided a debug log file

[github-actions]

Hello! 👋

Thank you for taking the time to open this issue with floccus. I know it's frustrating when software causes problems. You have made the right choice to come here and open an issue to make sure your problem gets looked at and if possible solved. Let me give you a short introduction on what to expect from this issue tracker to avoid misunderstandings. I'm Marcel. I created floccus a few years ago, and have been maintaining it since. I currently work for Nextcloud which leaves me with less time for side projects like this one than I used to have. I still try to answer all issues and if possible fix all bugs here, but it sometimes takes a while until I get to it. Until then, please be patient. It helps when you stick around to answer follow up questions I may have, as very few bugs can be fixed directly from the first bug report, without any interaction. If information is missing in your bug report and the issue cannot be solved without it, I will have to close the issue after a while. Note also that GitHub in general is a place where people meet to make software better together. Nobody here is under any obligation to help you, solve your problems or deliver on any expectations or demands you may have, but if enough people come together we can collaborate to make this software better. For everyone. Thus, if you can, you could also have a look at other issues to see whether you can help other people with your knowledge and experience. If you have coding experience it would also be awesome if you could step up to dive into the code and try to fix the odd bug yourself. Everyone will be thankful for extra helping hands! If you cannot lend a helping hand, to continue the development and maintenance of this project in a sustainable way, I ask that you donate to the project when opening an issue (or at least once your issue is solved), if you're not a donor already. You can find donation options at https://floccus.org/donate/. Thank you!

One last word: If you feel, at any point, like you need to vent, this is not the place for it; you can go to the Nextcloud forum, to twitter or somewhere else. But this is a technical issue tracker, so please make sure to focus on the tech and keep your opinions to yourself.

Thank you for reading through this primer. I look forward to working with you on this issue! Cheers! 💙

[marcelklehr]

Hi @ottoosworth
Thank you for taking the time to give feedback! The reason this works in the mobile app is that the mobile app currently doesn't implement the hardened upload-then-move strategy. Only the web extension implements this.

This appears to be a well-known nginx limitation/bug. The dav_ext/dav module's COPY and MOVE handlers don't correctly resolve the alias directive when computing the destination path. See https://trac.nginx.org/nginx/ticket/1108

Fix: use root instead of alias

nginx
location /webdav/ {
    root /home/wasabi9805/www;   # note: NOT the wasabi9805 dir directly

    client_body_temp_path /home/wasabi9805/webdav_tmp;
    dav_methods PUT DELETE MKCOL COPY MOVE;
    dav_ext_methods PROPFIND OPTIONS;
    create_full_put_path on;

    auth_basic "Webdav Restricted Access";
    auth_basic_user_file /home/wasabi9805/www/.htpasswd;

    satisfy all;
    allow all;
    deny all;
}

Key difference: with root, nginx appends the full URI (/webdav/...) onto the root path, so /webdav/file.txt → /home/wasabi9805/www/webdav/file.txt. That means you need an actual webdav subdirectory under your root (mkdir -p /home/wasabi9805/www/webdav), unlike alias, which strips the location prefix and serves straight from the target directory.

Also worth doing regardless: check your nginx version and upgrade if it predates the patch for CVE-2026-27654, since running this alias+MOVE/COPY combination on a vulnerable version is now a known security exposure, not just a broken feature.

I hope this helps :) Let me know if you have more questions

[ottoosworth]

Hi @ottoosworth Thank you for taking the time to give feedback! The reason this works in the mobile app is that the mobile app currently doesn't implement the hardened upload-then-move strategy. Only the web extension implements this.

This appears to be a well-known nginx limitation/bug. The dav_ext/dav module's COPY and MOVE handlers don't correctly resolve the alias directive when computing the destination path. See https://trac.nginx.org/nginx/ticket/1108

Fix: use root instead of alias

nginx
location /webdav/ {
    root /home/wasabi9805/www;   # note: NOT the wasabi9805 dir directly

    client_body_temp_path /home/wasabi9805/webdav_tmp;
    dav_methods PUT DELETE MKCOL COPY MOVE;
    dav_ext_methods PROPFIND OPTIONS;
    create_full_put_path on;

    auth_basic "Webdav Restricted Access";
    auth_basic_user_file /home/wasabi9805/www/.htpasswd;

    satisfy all;
    allow all;
    deny all;
}

Key difference: with root, nginx appends the full URI (/webdav/...) onto the root path, so /webdav/file.txt → /home/wasabi9805/www/webdav/file.txt. That means you need an actual webdav subdirectory under your root (mkdir -p /home/wasabi9805/www/webdav), unlike alias, which strips the location prefix and serves straight from the target directory.

Also worth doing regardless: check your nginx version and upgrade if it predates the patch for CVE-2026-27654, since running this alias+MOVE/COPY combination on a vulnerable version is now a known security exposure, not just a broken feature.

I hope this helps :) Let me know if you have more questions

hey @marcelklehr , I tried to introduce these changes and it it now works for deleting a bookmark and syncs succesfully, but when trying to add a bookmark it gives the same error "HTTP status 400. Failed MOVE request: Bad Request"