From 75773e4d7230a0d165d8c9767ba139e4caf0d78b Mon Sep 17 00:00:00 2001
From: Sai Asish Y <say.apm35@gmail.com>
Date: Wed, 13 May 2026 00:15:50 -0700
Subject: [PATCH] webdav: honour auth_redirect on listAll PROPFIND - fixes
 #9159

---
 backend/webdav/webdav.go               |  1 +
 backend/webdav/webdav_internal_test.go | 39 ++++++++++++++++++++++++++
 2 files changed, 40 insertions(+)

diff --git a/backend/webdav/webdav.go b/backend/webdav/webdav.go
index 8450c5a06..eec9c9e13 100644
--- a/backend/webdav/webdav.go
+++ b/backend/webdav/webdav.go
@@ -796,6 +796,7 @@ func (f *Fs) listAll(ctx context.Context, dir string, directoriesOnly bool, file
 		ExtraHeaders: map[string]string{
 			"Depth": depth,
 		},
+		AuthRedirect: f.opt.AuthRedirect, // allow redirects to preserve Auth
 	}
 	if f.hasOCMD5 || f.hasOCSHA1 {
 		opts.Body = bytes.NewBuffer(owncloudProps)
diff --git a/backend/webdav/webdav_internal_test.go b/backend/webdav/webdav_internal_test.go
index ee6cd7116..2aa7acd48 100644
--- a/backend/webdav/webdav_internal_test.go
+++ b/backend/webdav/webdav_internal_test.go
@@ -12,6 +12,7 @@ import (
 	"github.com/rclone/rclone/fs"
 	"github.com/rclone/rclone/fs/config/configfile"
 	"github.com/rclone/rclone/fs/config/configmap"
+	"github.com/rclone/rclone/fs/config/obscure"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -81,6 +82,44 @@ func TestHeaders(t *testing.T) {
 	require.NoError(t, err)
 }
 
+// TestListAllAuthRedirect checks auth_redirect is honoured on listAll PROPFIND.
+func TestListAllAuthRedirect(t *testing.T) {
+	var targetAuth string
+	var targetHits int
+
+	target := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		targetHits++
+		targetAuth = r.Header.Get("Authorization")
+		_, err := fmt.Fprint(w, `<d:multistatus xmlns:d="DAV:"></d:multistatus>`)
+		require.NoError(t, err)
+	}))
+	defer target.Close()
+
+	// Redirect via a different hostname so net/http strips Authorization on cross-host redirect.
+	targetURL := strings.Replace(target.URL, "127.0.0.1", "localhost", 1)
+	source := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.Redirect(w, r, targetURL+r.URL.Path, http.StatusTemporaryRedirect)
+	}))
+	defer source.Close()
+
+	configfile.Install()
+	m := configmap.Simple{
+		"type":          "webdav",
+		"url":           source.URL,
+		"user":          "alice",
+		"pass":          obscure.MustObscure("secret"),
+		"auth_redirect": "true",
+	}
+
+	f, err := webdav.NewFs(context.Background(), remoteName, "", m)
+	require.NoError(t, err)
+
+	_, _ = f.List(context.Background(), "")
+
+	assert.GreaterOrEqual(t, targetHits, 1, "redirect target should receive the request")
+	assert.NotEmpty(t, targetAuth, "Authorization header should be preserved across redirect")
+}
+
 // TestReservedCharactersInPathAreEscaped verifies that reserved characters
 // like semicolons and equals signs in file paths are percent-encoded in
 // HTTP requests to the WebDAV server (RFC 3986 compliance).