Efficient handling of denied CalDAV-Requests

This is a cryptographically signed message in MIME format.

--===============7527728409443376867==
Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="------------ms040405080809070107040603"

This is a cryptographically signed message in MIME format.

--------------ms040405080809070107040603
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: quoted-printable

Hi,

in our setup, we have a number of users that use CalDAV to access both=20
their own calendars and calendars that other users have shared with=20
them. Of the shared calendars, of course not all allow write access.

When a CalDAV client tries to write to such a calendar for which it does =

not have permissions, then of course access to it is denied and the=20
calendar remains unchanged.  However, there seem to be many clients out=20
there that repeat this kind of "unsuccessful" request over and over=20
again.  That is, these clients to not get the fact that they will never=20
be able to write to the calendar and over time they send a huge amount=20
of requests that have to be denied each and every time.  The amount of=20
requests grows steadily as CalDAV users keep adding events to calendars=20
that they cannot write to -- in the CalDAV client, these events are=20
often displayed just fine.

These denied requests already make up a substantial amount of the total=20
traffic we see on our Horde servers.  We already tried to block some of=20
these requests on the webserver level, but with limited success.  In=20
such an event, the clients will receive an HTTP error 403 from Apache=20
when trying to write to a certain calendar that they are not supposed to =

write to, but even that does not stop them from retrying the write=20
request every couple of seconds.  So having Apache block requests is a=20
nice start because it costs less performance than a full-blown Horde PHP =

request with authentication and what else, but fiddling with the Apache=20
config to sort out which requests to deny is pretty complicated and=20
error prone.

So it looks like we have to deal with the fact that these kinds of=20
requests show up often.  As a result, I am looking for other/better ways =

to handle these kinds of repeating nonsense requests.  Has anyone got=20
similar trouble and found a way around it?  For example, does putting a=20
Varnish server in front help?  I'm not sure if Varnish would be able to=20
cache the "access denied" answer to "HTTP basic" authenticated CalDAV=20
(WebDAV) requests.


Jens



--------------ms040405080809070107040603
Content-Type: application/pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature

MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC
D3swggTVMIIDvaADAgECAghQTsb1PRG0ZDANBgkqhkiG9w0BAQsFADBxMQswCQYDVQQGEwJE
RTEcMBoGA1UEChMTRGV1dHNjaGUgVGVsZWtvbSBBRzEfMB0GA1UECxMWVC1UZWxlU2VjIFRy
dXN0IENlbnRlcjEjMCEGA1UEAxMaRGV1dHNjaGUgVGVsZWtvbSBSb290IENBIDIwHhcNMTQw
NzIyMTIwODI2WhcNMTkwNzA5MjM1OTAwWjBaMQswCQYDVQQGEwJERTETMBEGA1UEChMKREZO
LVZlcmVpbjEQMA4GA1UECxMHREZOLVBLSTEkMCIGA1UEAxMbREZOLVZlcmVpbiBQQ0EgR2xv
YmFsIC0gRzAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6ZvDZ4X5Da71jVTD
llA1PWLpbkztlNcAW5UidNQg6zSP1uzAMQQLmYHiphTSUqAoI4SLdIkEXlvg4njBeMsWyyg1
OXstkEXQ7aAAeny/Sg4bAMOG6VwrMRF7DPOCJEOMHDiLamgAmu7cT3ir0sYTm3at7t4m6O8B
r3QPwQmi9mvOvdPNFDBP9eXjpMhim4IaAycwDQJlYE3t0QkjKpY1WCfTdsZxtpAdxO3/NYZ9
bzOz2w/FEcKKg6GUXUFr2NIQ9Uz9ylGs2b3vkoO72uuLFlZWQ8/h1RM9ph8nMM1JVNvJEzSa
cXXFbOqnC5j5IZ0nrz6jOTlIaoytyZn7wxLyvQIDAQABo4IBhjCCAYIwDgYDVR0PAQH/BAQD
AgEGMB0GA1UdDgQWBBRJt8bP6D0ff+pEexMp9/EKcD7eZDAfBgNVHSMEGDAWgBQxw3kbuvVT
1xfgiXotF2wKsyudMzASBgNVHRMBAf8ECDAGAQH/AgECMGIGA1UdIARbMFkwEQYPKwYBBAGB
rSGCLAEBBAICMBEGDysGAQQBga0hgiwBAQQDADARBg8rBgEEAYGtIYIsAQEEAwEwDwYNKwYB
BAGBrSGCLAEBBDANBgsrBgEEAYGtIYIsHjA+BgNVHR8ENzA1MDOgMaAvhi1odHRwOi8vcGtp
MDMzNi50ZWxlc2VjLmRlL3JsL0RUX1JPT1RfQ0FfMi5jcmwweAYIKwYBBQUHAQEEbDBqMCwG
CCsGAQUFBzABhiBodHRwOi8vb2NzcDAzMzYudGVsZXNlYy5kZS9vY3NwcjA6BggrBgEFBQcw
AoYuaHR0cDovL3BraTAzMzYudGVsZXNlYy5kZS9jcnQvRFRfUk9PVF9DQV8yLmNlcjANBgkq
hkiG9w0BAQsFAAOCAQEAYyAo/ZwhhnK+OUZZOTIlvKkBmw3Myn1BnIZtCm4ssxNZdbEzkhth
Jxb/w7LVNYL7hCoBSb1mu2YvssIGXW4/buMBWlvKQ2NclbbhMacf1QdfTeZlgk4y+cN8ekvN
TVx07iHydQLsUj7SyWrTkCNuSWc1vn9NVqTszC/Pt6GXqHI+ybxA1lqkCD3WvILDt7cyjrEs
jmpttzUCGc/1OURYY6ckABCwu/xOr24vOLulV0k/2G5QbyyXltwdRpplic+uzPLl2Z9Tsz6h
L5Kp2AvGhB8Exuse6J99tXulAvEkxSRjETTMWpMgKnmIOiVCkKllO3yG0xIVIyn8LNrMOVtU
FzCCBUIwggQqoAMCAQICBxflrmHmhu8wDQYJKoZIhvcNAQELBQAweTELMAkGA1UEBhMCREUx
DjAMBgNVBAcTBUtvZWxuMR4wHAYDVQQKExVVbml2ZXJzaXRhZXQgenUgS29lbG4xFDASBgNV
BAMTC1VuaUtvZWxuIENBMSQwIgYJKoZIhvcNAQkBFhVjYW1hc3RlckB1bmkta29lbG4uZGUw
HhcNMTQwNzE2MDc1OTEzWhcNMTcwNzE1MDc1OTEzWjBTMQswCQYDVQQGEwJERTEOMAwGA1UE
BxMFS29lbG4xHjAcBgNVBAoTFVVuaXZlcnNpdGFldCB6dSBLb2VsbjEUMBIGA1UEAxMLSmVu
cyBXYWhuZXMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDmtanYAmvF/Kdqe5MA
2fGwVOjpIfAI8Kq/jED3w52QQ9w8pXG3B89aJbTtFWgfXAkYMICxiOvfvxGzpfcY+1bO9bF5
TLfEQY7AkcQZz95/kbS5cfjqcgCL2EmIJTF1kt76i+pURk/lcTXbdt2UtgsrI/aZy9oZ5lBk
rve/qv9166YrdunKLmasiNhUfsmJyYCKe1L4C153TH0s9fv0KbbLkAM+LOPGJzm4k5/QC/h3
cdPsSMFSfe/eHfOqtjF/LkWEzbpLhfJtioWF2zq1kD1GsX+Bf6ZCGzebYFAIf2okbTjN6QeT
HuZ/NLpTim2EO+99KoAeNg5nD85exzCsgj0nAgMBAAGjggHzMIIB7zAvBgNVHSAEKDAmMBEG
DysGAQQBga0hgiwBAQQDATARBg8rBgEEAYGtIYIsAgEEAwEwCQYDVR0TBAIwADALBgNVHQ8E
BAMCBeAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMB0GA1UdDgQWBBQS598BlGJL
D5j7Rc91nn01u+e2LjAfBgNVHSMEGDAWgBQq6onrDrLQKcX++Uyldty3b08JujAeBgNVHREE
FzAVgRN3YWhuZXNAdW5pLWtvZWxuLmRlMIGDBgNVHR8EfDB6MDugOaA3hjVodHRwOi8vY2Rw
MS5wY2EuZGZuLmRlL3VuaS1rb2Vsbi1jYS9wdWIvY3JsL2NhY3JsLmNybDA7oDmgN4Y1aHR0
cDovL2NkcDIucGNhLmRmbi5kZS91bmkta29lbG4tY2EvcHViL2NybC9jYWNybC5jcmwwgZ4G
CCsGAQUFBwEBBIGRMIGOMEUGCCsGAQUFBzAChjlodHRwOi8vY2RwMS5wY2EuZGZuLmRlL3Vu
aS1rb2Vsbi1jYS9wdWIvY2FjZXJ0L2NhY2VydC5jcnQwRQYIKwYBBQUHMAKGOWh0dHA6Ly9j
ZHAyLnBjYS5kZm4uZGUvdW5pLWtvZWxuLWNhL3B1Yi9jYWNlcnQvY2FjZXJ0LmNydDANBgkq
hkiG9w0BAQsFAAOCAQEAG8sf4iQv83EDiaKjN+U7a4mQ5c7TU5zgwUWSwDRlQinIaDZGUCW7
KijueYW8IyqqXZOgGFAtqNdG9ptJoASgkp4nnS3RjLzylhknP29U6y59Js5SQ4z1gyilQxMc
2vaXcQpAuXSwl7GRp/PXZ/Pamp93K4xA2UL08aqZgAPrT9C4Tp1Lc3qpPOSE28tLF+LzKBmt
7F5w5JUmMN0eWbx3knmfy/oPutxtGMh36Wz7KClfl9IxipzZH9Aqt9tIP1cCSuT54REiVU/A
bMQ111Wmwnd1sRshlve/UtHjrz4R3+g5xDYv0c74VkZGN2wZwTDkvnSUdgCCkmXix2WNtaw7
XTCCBVgwggRAoAMCAQICBxeZoCDisrAwDQYJKoZIhvcNAQELBQAwWjELMAkGA1UEBhMCREUx
EzARBgNVBAoTCkRGTi1WZXJlaW4xEDAOBgNVBAsTB0RGTi1QS0kxJDAiBgNVBAMTG0RGTi1W
ZXJlaW4gUENBIEdsb2JhbCAtIEcwMTAeFw0xNDA1MTkxNTI2MDhaFw0xOTA3MDkyMzU5MDBa
MHkxCzAJBgNVBAYTAkRFMQ4wDAYDVQQHEwVLb2VsbjEeMBwGA1UEChMVVW5pdmVyc2l0YWV0
IHp1IEtvZWxuMRQwEgYDVQQDEwtVbmlLb2VsbiBDQTEkMCIGCSqGSIb3DQEJARYVY2FtYXN0
ZXJAdW5pLWtvZWxuLmRlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAy8T3o90m
6w39qVH3SfDBXhiIs0zUA0xPZc3gxt+eLKB4bOC8xftPyO5UPDgf0tG16F8G+M+owzue2HVF
HmT+BI7JTJFTNw0tlL5RW7RtcBF3VZyR5LyagRGtX7/ccw+o0Im6TrukuOjBjDWmyNriqwlp
PzI6GltqdzeZkhr22r53iYtnQu9lWG4XGFsh1+X5/ZqCyRBtthtRFw8sf+ey8q28ScoN9wd5
UkZfSF9HtkFCEJ7xeIpQ2Eop1BXrVQ7vW/Dt0/fHMbw9AfdKeFkpN5iEJTtiBbzY9e2/boMI
MiDqInK44OotjBdONzXrTU2hOgMw3pYYY/R4L986eKmbowIDAQABo4ICAjCCAf4wEgYDVR0T
AQH/BAgwBgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwEQYDVR0gBAowCDAGBgRVHSAAMB0GA1Ud
DgQWBBQq6onrDrLQKcX++Uyldty3b08JujAfBgNVHSMEGDAWgBRJt8bP6D0ff+pEexMp9/EK
cD7eZDAgBgNVHREEGTAXgRVjYW1hc3RlckB1bmkta29lbG4uZGUwgYgGA1UdHwSBgDB+MD2g
O6A5hjdodHRwOi8vY2RwMS5wY2EuZGZuLmRlL2dsb2JhbC1yb290LWNhL3B1Yi9jcmwvY2Fj
cmwuY3JsMD2gO6A5hjdodHRwOi8vY2RwMi5wY2EuZGZuLmRlL2dsb2JhbC1yb290LWNhL3B1
Yi9jcmwvY2FjcmwuY3JsMIHXBggrBgEFBQcBAQSByjCBxzAzBggrBgEFBQcwAYYnaHR0cDov
L29jc3AucGNhLmRmbi5kZS9PQ1NQLVNlcnZlci9PQ1NQMEcGCCsGAQUFBzAChjtodHRwOi8v
Y2RwMS5wY2EuZGZuLmRlL2dsb2JhbC1yb290LWNhL3B1Yi9jYWNlcnQvY2FjZXJ0LmNydDBH
BggrBgEFBQcwAoY7aHR0cDovL2NkcDIucGNhLmRmbi5kZS9nbG9iYWwtcm9vdC1jYS9wdWIv
Y2FjZXJ0L2NhY2VydC5jcnQwDQYJKoZIhvcNAQELBQADggEBAICGuE6ccpBsugZttw4/8n4z
2QZ+G9QuINfipaH6Fit/XJY57yTFbTR13npkOZBkyX471SVmdwDYrXBqNwjVUeqFHvPcYvYR
x5Yg+uAQ12hbn4LgG+2rpSH7Db41iyGZHPYfKQZKT5NXV+7O1sRKUQbv3ctAQvWbMGG00uev
vumacsqClM39y3YgsnVC+UE1ubVTPHzVu7RjVowaMpGNIqlYbxDv8/+fxQPGx4BO7d50qoAV
VBxWaNxp8KARAXjSn+FCcfD17npJ7kSJzA7lGYONYSeq9jxUmaFxfB9RhxMymbPOARx5LIPf
TSoAok44GVksdwwm0qH/YDxyVVPDqksxggO9MIIDuQIBATCBhDB5MQswCQYDVQQGEwJERTEO
MAwGA1UEBxMFS29lbG4xHjAcBgNVBAoTFVVuaXZlcnNpdGFldCB6dSBLb2VsbjEUMBIGA1UE
AxMLVW5pS29lbG4gQ0ExJDAiBgkqhkiG9w0BCQEWFWNhbWFzdGVyQHVuaS1rb2Vsbi5kZQIH
F+WuYeaG7zANBglghkgBZQMEAgEFAKCCAgkwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAc
BgkqhkiG9w0BCQUxDxcNMTYwMzMxMTQ1MTE2WjAvBgkqhkiG9w0BCQQxIgQgsSGZsLiCHfEP
F+G/xyRbZQ2QgA/P/4H1D/Az0dLpntIwbAYJKoZIhvcNAQkPMV8wXTALBglghkgBZQMEASow
CwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIAgDANBggqhkiG9w0DAgIB
QDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBlQYJKwYBBAGCNxAEMYGHMIGEMHkxCzAJBgNV
BAYTAkRFMQ4wDAYDVQQHEwVLb2VsbjEeMBwGA1UEChMVVW5pdmVyc2l0YWV0IHp1IEtvZWxu
MRQwEgYDVQQDEwtVbmlLb2VsbiBDQTEkMCIGCSqGSIb3DQEJARYVY2FtYXN0ZXJAdW5pLWtv
ZWxuLmRlAgcX5a5h5obvMIGXBgsqhkiG9w0BCRACCzGBh6CBhDB5MQswCQYDVQQGEwJERTEO
MAwGA1UEBxMFS29lbG4xHjAcBgNVBAoTFVVuaXZlcnNpdGFldCB6dSBLb2VsbjEUMBIGA1UE
AxMLVW5pS29lbG4gQ0ExJDAiBgkqhkiG9w0BCQEWFWNhbWFzdGVyQHVuaS1rb2Vsbi5kZQIH
F+WuYeaG7zANBgkqhkiG9w0BAQEFAASCAQBOEm6P2VTgSyzKrz06IsZdGIrtU2a8TtGzxFHO
Qzo4mRJsPJWnAsIcSkvxRPmeNQr36vXb7wYaRv9BnlplKRGfNg8jIrx9Lwhl0vp3KSgsL2DU
i8ImzuJ45VVUoJb4fkfn5Znj1X4AakT0Vii9w6cFaQwKAQUiJ5daYnL98Ob8IVnDLMnphLa5
F2YWhfaa7931HU1RmXqiRIs8J3GIw9tZ95ObYHbda8BW/UJr0+Q6I8f1uSLUwwzgW/SEKV5R
4A3n7Og7ndevmLPKH8j5wtvPZpucQyaoEVCsIZVV5z3HnNizoWm3PVTcbLENGknT0H13W2VR
xTHQpKP2SYD+ZGfjAAAAAAAA
--------------ms040405080809070107040603--

--===============7527728409443376867==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

-- 
sync mailing list
Frequently Asked Questions: http://wiki.horde.org/FAQ
To unsubscribe, mail: [email protected]
--===============7527728409443376867==--