Upgrade StorageWebDAV uploads fail on Zotero 8 (PUT sent without Authorization, server closes connection)
Environment
Zotero 8.0 (Windows 11 x64)
WebDAV server: OpenList WebDAV (behind reverse proxy / also reproducible on LAN)
Works on Zotero 7 with the same WebDAV settings
Download/GET works on Zotero 8; only attachment upload (PUT .zip) fails
Summary
After upgrading from Zotero 7 to Zotero 8, WebDAV sync fails only for attachment uploads. Zotero 8 appears to send PUT requests without Authorization first, then expects to retry after receiving 401 + WWW-Authenticate. On my WebDAV server (OpenList), the first unauthenticated PUT returns 401 and immediately closes the connection, which causes the upload to fail (Zotero reports upload failure / “HTTP 0”-style errors). Zotero 7 preemptively includes Authorization on the PUT and succeeds.
I will attach sanitized packet captures for both Zotero 7 and Zotero 8 (credentials removed; binary bodies truncated/filtered).
Expected behavior
WebDAV attachment uploads should succeed on Zotero 8 with servers that require Basic auth, as they do on Zotero 7.
Actual behavior
On Zotero 8, attachment upload PUT ...zip receives 401 Unauthorized and Connection: close on the initial request (no Authorization header), causing the upload to fail.
Why this matters
Many WebDAV servers/proxies close the connection after rejecting an unauthenticated PUT to avoid receiving a large request body. Clients typically avoid sending the body before authentication (e.g., by preemptive auth for known endpoints, or using Expect: 100-continue / a preflight request to trigger the challenge).
Packet capture excerpt (sanitized)
Zotero 7 (works): preemptive Authorization
GET /dav/nas/server/sync/zotero/TUSZRRVE.prop HTTP/1.1
Host: XXX.XXXXXX.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Authorization: Basic XXXX
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Date: Fri, 23 Jan 2026 11:30:19 GMT
Content-Length: 9
Content-Type: text/plain; charset=utf-8
Not Found
PUT /dav/nas/server/sync/zotero/TUSZRRVE.zip HTTP/1.1
Host: XXX.XXXXXX.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/zip
Content-Length: 15084197
Authorization: Basic XXXX
Connection: keep-alive
PK..........7\.X..#*........ .111.pdfUT....;si..UT^..5.$....wwww..w.............[...?y.......\...7.Vw..YU.."W...c...'......af.."b$.7....e...35.Zz...11..1qpqqrp.0(.13r21..1s...q1..1.1..5..... I.C...N.......ojg.gA....=8.....)...T..h...&bo.bk.D....45..8.........-m.M...6F..... %..........$.!.).&.!.....$..(.....$...*..!*.&**..%..*.)......*.!,...&... egb......9..dM...-..X.....[.1(..;..8.....T>`!bfb.`P.p0e.T65c..a"b&b....3......b...........%"...
W.!......~
7.
HTTP/1.1 201 Created
Date: Fri, 23 Jan 2026 11:30:23 GMT
Content-Length: 7
Content-Type: text/plain; charset=utf-8
Created
PUT /dav/nas/server/sync/zotero/TUSZRRVE.prop HTTP/1.1
Host: XXX.XXXXXX.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: text/xml
Content-Length: 110
Authorization: Basic XXXX
Connection: keep-alive
17691595944706d3edb1ef85b1262ff2cc09c98db054c
HTTP/1.1 201 Created
Date: Fri, 23 Jan 2026 11:30:24 GMT
Content-Length: 7
Content-Type: text/plain; charset=utf-8
Created
Zotero 8 (fails): PUT sent without Authorization first
GET /dav/nas/server/sync/zotero/M39DP52B.prop HTTP/1.1
Host: XXX.XXXXXX.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0 Zotero/8.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 401 Unauthorized
WWW-Authenticate: Basic realm="openlist"
Date: Fri, 23 Jan 2026 11:37:06 GMT
Content-Length: 0
GET /dav/nas/server/sync/zotero/M39DP52B.prop HTTP/1.1
Host: XXX.XXXXXX.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0 Firefox/140.0 Zotero/8.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Authorization: Basic XXXX
HTTP/1.1 404 Not Found
Date: Fri, 23 Jan 2026 11:37:06 GMT
Content-Length: 9
Content-Type: text/plain; charset=utf-8
Not Found
PUT /dav/nas/server/sync/zotero/M39DP52B.zip HTTP/1.1
Host: XXX.XXXXXX.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0 Zotero/8.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/zip
Content-Length: 15084197
Connection: keep-alive
PK..........7\.X..#*........ .111.pdfUT....;si..UT^..5.$....wwww..w.............[...?y.......\...7.Vw..YU.."W...c...'......af.."b$.7....e...35.Zz...11..1qpqqrp.0(.13r21..1s...q1..1.1..5..... I.C...N.......ojg.gA....=8.....)...T..h...&bo.bk.D....45..8.........-m.M...6F..... %..........$.!.).&.!.....$..(.....$...*..!*.&**..%..*.)......*.!,...&... egb......9..dM...-..X.....[.1(..;..8.....T>`!bfb.`P.p0e.T65c..a"b&b....3......b...........%"...
W.!......~
HTTP/1.1 401 Unauthorized
WWW-Authenticate: Basic realm="openlist"
Date: Fri, 23 Jan 2026 11:37:07 GMT
Content-Length: 0
Connection: close
Zotero 8.0 (Windows 11 x64)
WebDAV server: OpenList WebDAV (behind reverse proxy / also reproducible on LAN)
Works on Zotero 7 with the same WebDAV settings
Download/GET works on Zotero 8; only attachment upload (PUT .zip) fails
Summary
After upgrading from Zotero 7 to Zotero 8, WebDAV sync fails only for attachment uploads. Zotero 8 appears to send PUT requests without Authorization first, then expects to retry after receiving 401 + WWW-Authenticate. On my WebDAV server (OpenList), the first unauthenticated PUT returns 401 and immediately closes the connection, which causes the upload to fail (Zotero reports upload failure / “HTTP 0”-style errors). Zotero 7 preemptively includes Authorization on the PUT and succeeds.
I will attach sanitized packet captures for both Zotero 7 and Zotero 8 (credentials removed; binary bodies truncated/filtered).
Expected behavior
WebDAV attachment uploads should succeed on Zotero 8 with servers that require Basic auth, as they do on Zotero 7.
Actual behavior
On Zotero 8, attachment upload PUT ...zip receives 401 Unauthorized and Connection: close on the initial request (no Authorization header), causing the upload to fail.
Why this matters
Many WebDAV servers/proxies close the connection after rejecting an unauthenticated PUT to avoid receiving a large request body. Clients typically avoid sending the body before authentication (e.g., by preemptive auth for known endpoints, or using Expect: 100-continue / a preflight request to trigger the challenge).
Packet capture excerpt (sanitized)
Zotero 7 (works): preemptive Authorization
GET /dav/nas/server/sync/zotero/TUSZRRVE.prop HTTP/1.1
Host: XXX.XXXXXX.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Authorization: Basic XXXX
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Date: Fri, 23 Jan 2026 11:30:19 GMT
Content-Length: 9
Content-Type: text/plain; charset=utf-8
Not Found
PUT /dav/nas/server/sync/zotero/TUSZRRVE.zip HTTP/1.1
Host: XXX.XXXXXX.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/zip
Content-Length: 15084197
Authorization: Basic XXXX
Connection: keep-alive
PK..........7\.X..#*........ .111.pdfUT....;si..UT^..5.$....wwww..w.............[...?y.......\...7.Vw..YU.."W...c...'......af.."b$.7....e...35.Zz...11..1qpqqrp.0(.13r21..1s...q1..1.1..5..... I.C...N.......ojg.gA....=8.....)...T..h...&bo.bk.D....45..8.........-m.M...6F..... %..........$.!.).&.!.....$..(.....$...*..!*.&**..%..*.)......*.!,...&... egb......9..dM...-..X.....[.1(..;..8.....T>`!bfb.`P.p0e.T65c..a"b&b....3......b...........%"...
W.!......~
7.
HTTP/1.1 201 Created
Date: Fri, 23 Jan 2026 11:30:23 GMT
Content-Length: 7
Content-Type: text/plain; charset=utf-8
Created
PUT /dav/nas/server/sync/zotero/TUSZRRVE.prop HTTP/1.1
Host: XXX.XXXXXX.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: text/xml
Content-Length: 110
Authorization: Basic XXXX
Connection: keep-alive
17691595944706d3edb1ef85b1262ff2cc09c98db054c
HTTP/1.1 201 Created
Date: Fri, 23 Jan 2026 11:30:24 GMT
Content-Length: 7
Content-Type: text/plain; charset=utf-8
Created
Zotero 8 (fails): PUT sent without Authorization first
GET /dav/nas/server/sync/zotero/M39DP52B.prop HTTP/1.1
Host: XXX.XXXXXX.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0 Zotero/8.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 401 Unauthorized
WWW-Authenticate: Basic realm="openlist"
Date: Fri, 23 Jan 2026 11:37:06 GMT
Content-Length: 0
GET /dav/nas/server/sync/zotero/M39DP52B.prop HTTP/1.1
Host: XXX.XXXXXX.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0 Firefox/140.0 Zotero/8.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Authorization: Basic XXXX
HTTP/1.1 404 Not Found
Date: Fri, 23 Jan 2026 11:37:06 GMT
Content-Length: 9
Content-Type: text/plain; charset=utf-8
Not Found
PUT /dav/nas/server/sync/zotero/M39DP52B.zip HTTP/1.1
Host: XXX.XXXXXX.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0 Zotero/8.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/zip
Content-Length: 15084197
Connection: keep-alive
PK..........7\.X..#*........ .111.pdfUT....;si..UT^..5.$....wwww..w.............[...?y.......\...7.Vw..YU.."W...c...'......af.."b$.7....e...35.Zz...11..1qpqqrp.0(.13r21..1s...q1..1.1..5..... I.C...N.......ojg.gA....=8.....)...T..h...&bo.bk.D....45..8.........-m.M...6F..... %..........$.!.).&.!.....$..(.....$...*..!*.&**..%..*.)......*.!,...&... egb......9..dM...-..X.....[.1(..;..8.....T>`!bfb.`P.p0e.T65c..a"b&b....3......b...........%"...
W.!......~
HTTP/1.1 401 Unauthorized
WWW-Authenticate: Basic realm="openlist"
Date: Fri, 23 Jan 2026 11:37:07 GMT
Content-Length: 0
Connection: close
To avoid impacting my production setup, I reproduced the issue in an isolated test environment using a plain HTTP WebDAV endpoint (IP + port): http://10.0.0.15:25244.
What I observe:
The first upload request (PUT) is still sent without an Authorization header.
The server replies 401 Unauthorized and then closes the connection.
Because the PUT already includes a large request body, the connection close leads to the upload failing on the client side (same pattern as before).
Thanks again for looking into this @dstillman — I appreciate your help.
The latest TCP stream capture is as follows:
OPTIONS /dav/server/sync/zotero/ HTTP/1.1
Host: 10.0.0.15:25244
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0 Zotero/8.0.2-beta.2+56cd4713f
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: keep-alive
HTTP/1.1 200 OK
Allow: OPTIONS, LOCK, DELETE, PROPPATCH, COPY, MOVE, UNLOCK, PROPFIND
Dav: 1, 2
Ms-Author-Via: DAV
Date: Wed, 04 Feb 2026 03:35:07 GMT
Content-Length: 0
GET /dav/server/sync/zotero/RPC2IAIL.prop HTTP/1.1
Host: 10.0.0.15:25244
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0 Zotero/8.0.2-beta.2+56cd4713f
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 401 Unauthorized
WWW-Authenticate: Basic realm="openlist"
Date: Wed, 04 Feb 2026 03:35:07 GMT
Content-Length: 0
GET /dav/server/sync/zotero/RPC2IAIL.prop HTTP/1.1
Host: 10.0.0.15:25244
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0 Firefox/140.0 Zotero/8.0.2-beta.2+56cd4713f
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Authorization: Basic ZGF5ZXBhbzpMeWgwMTAxMjAh
HTTP/1.1 404 Not Found
Date: Wed, 04 Feb 2026 03:35:07 GMT
Content-Length: 9
Content-Type: text/plain; charset=utf-8
Not Found
PUT /dav/server/sync/zotero/RPC2IAIL.zip HTTP/1.1
Host: 10.0.0.15:25244
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0 Zotero/8.0.2-beta.2+56cd4713f
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/zip
Content-Length: 10211951
Connection: keep-alive
PK..........;\..-......r..p. .Zhao ... - 2022 - Intelligent design method for beam and slab of shear wall structure based on deep learning.pdfUT...8xxi..u\...7.tKH.....,.]....."..
HTTP/1.1 401 Unauthorized
WWW-Authenticate: Basic realm="openlist"
Date: Wed, 04 Feb 2026 03:35:07 GMT
Content-Length: 0
Connection: close
Zotero is sending the WebDAV PUT request with Authorization preemptively (i.e., the first request already includes Basic auth), and the sync completes successfully.
As an additional check, I also tested with a commonly used WebDAV provider (坚果云Jianguoyun), and everything works as expected there as well.
Really appreciate the quick fix and your help on this! @dstillman