As part of a bigger swarm of ideas, I've been trying to figure out how easy it is to use existing, ubiquitous technologies to implement remotely editable secure storage. Since WebDAV is HTTP-based, it is typically straightforward to combine it with other features of a web server to provide authentication, authorization and a secure transport layer. At least, this appears to be the case for an Apache-based WebDAV server using mod_dav, mod_ssl and mod_auth.

On a similar track, I've been trying to figure out how easy it is to use Zope with SSL. M2Crypto, a Python crypto and SSL toolkit, includes ZServerSSL, which provides an HTTPS server that works just like the HTTP server (but with SSL). That's great! But what I was hoping to find was a way to add SSL to Zope's WebDAV server.

Another common way SSL is added to Zope is via an Apache proxy: An Apache SSL web site is configured to reverse-proxy traffic to an otherwise non-SSL Zope port. (I assume there would also be a way to block access to the Zope port for everything but the proxy, perhaps with the usual firewall techniques.) I don't know how much gets proxied by the proxy-based solutions, but if it preserves the WebDAV-y bits, it could work.

WebDAV clients that support SSL are a separate question, but I haven't tested anything yet. This WebDAV client testing chart is out of date, but is a good starting point. I've found a few old mentions that Mac OS X's WebDAV feature doesn't support SSL, but they all refer to Mac OS X 10.2 or older. Some of these mentions point to Goliath as an SSL-WebDAV solution for Mac users. I'll have to set up such a server to figure out if Mac OS X 10.3+ does any better.

Windows users appear to be in luck, at least with some configurations. DavFS2 for Linux explicitly claims to support SSL.

On another note, I'm impressed how few web hosting providers offer WebDAV support. I was hoping to be able to glue WebDAV clients onto some of my favorite apps, then recommend it to people as a secure remote storage and sync'ing solution using open technologies. I should be able to piece something together on my personal server, but a mainstream audience will want hosting and one-click client apps.