WebDAV Datasource for Dify

Browse and ingest files from any WebDAV server — Nextcloud, ownCloud, Apache
, sabre/dav, and other RFC 4918 compliant servers — into Dify as an
online drive datasource. Navigate folders, pick files, and Dify downloads
and ingests them.

Configuration

Configure the datasource in Dify with three credentials:

Nextcloud example

Nextcloud and ownCloud expose per-user WebDAV under :

For a generic Apache share the is simply the share URL,
for example .

Credentials are validated on save with a request against .

How it works

• Browse issues a against the selected folder and
  parses the multistatus XML into folders and files (name, size, type).
• Download issues a plain for the chosen file and streams its bytes
  (with the server's ) back to Dify for ingestion.
• Folder navigation uses the resource path as the id; files use their full
  server path.

The WebDAV protocol logic lives in the package (a thin
parser and HTTP client built on + ), independent of
the Dify SDK and unit-tested with mocked HTTP. The datasource class is a thin
adapter over the SDK's interface.

Behaviour and caveats

• A broken or partial XML response raises rather than returning an empty
  listing. The parser uses a hardened lxml configuration (no DTD,
  no entity resolution, no network, no huge trees) and rejects any document
  carrying a (XXE / "billion laughs" defence). A syntactically broken
  multistatus body now raises an error instead of silently degrading to a
  partial or empty list — so a malfunctioning server is distinguishable from a
  genuinely empty folder. An empty folder is a well-formed multistatus that
  lists only the collection itself (which is excluded), yielding .
• Redirects are intentionally not followed () as an
  SSRF guard, so a legitimate / from the server surfaces as an
  "unexpected response" error rather than being chased. Point at the
  final, canonical collection URL.
• The pagination cursor re-reads the directory between pages. WebDAV
  has no server-side paging, so each page re-lists the folder and
  slices it client-side. If the folder changes mid-crawl you can get duplicate
  or skipped entries between pages — acceptable for ingest, but not a
  point-in-time snapshot.
• Credentials are never echoed in error text. If embeds
  , any userinfo is stripped from error messages
  before they reach Dify / the LLM.

Development

This plugin uses uv with +
(there is no ).

Without uv, create a virtualenv and install the runtime + dev tools manually:

License

Apache-2.0 © 2026 Alexey Shabalin

Repository

https://github.com/shaba/dify-datasource-webdav