HTTP 423 Locked

HTTP 423 is Locked: the source or destination resource of the method is locked, so the change can’t be made now (RFC 4918 section 11.3). It comes from WebDAV, where a client locks a document before editing it so nobody else overwrites the work. The response should carry a precondition code in an XML body, such as lock-token-submitted or no-conflicting-lock.

The exchange

One client takes an exclusive write lock:

LOCK /docs/plan.docx HTTP/1.1
Timeout: Second-3600
Content-Type: application/xml; charset="utf-8"

<?xml version="1.0" encoding="utf-8"?>
<D:lockinfo xmlns:D="DAV:">
  <D:lockscope><D:exclusive/></D:lockscope>
  <D:locktype><D:write/></D:locktype>
</D:lockinfo>

HTTP/1.1 200 OK
Lock-Token: <urn:uuid:e71d4fae-5dec-22d6-fea5-00a0c91e6be4>

Another tries to save without the token:

PUT /docs/plan.docx HTTP/1.1

HTTP/1.1 423 Locked
Content-Type: application/xml; charset="utf-8"

<?xml version="1.0" encoding="utf-8"?>
<D:error xmlns:D="DAV:">
  <D:lock-token-submitted>
    <D:href>/docs/plan.docx</D:href>
  </D:lock-token-submitted>
</D:error>

The lock holder proves itself by sending If: (<urn:uuid:e71d4fae-5dec-22d6-fea5-00a0c91e6be4>) with its own writes, and ends with UNLOCK and the token in a Lock-Token header, which answers 204 No Content.

Who sends it

WebDAV servers: Apache’s mod_dav, IIS’s WebDAV module, and SabreDAV, which Nextcloud and ownCloud are built on. The clients that take locks include Microsoft Office, LibreOffice, Windows Explorer’s WebDAV support and the macOS Finder. A few non-WebDAV APIs borrow 423 for a record someone else is editing; clients outside WebDAV only know it as a 4xx.

A stale lock

A crashed editor can leave a lock behind. A PROPFIND for the DAV:lockdiscovery property shows who holds it, its token and its timeout. Wait for the timeout to pass, or, if it’s your own lock, UNLOCK it with the token. Retrying the write straight away won’t help.

curl -X UNLOCK -H 'Lock-Token: <urn:uuid:e71d4fae-5dec-22d6-fea5-00a0c91e6be4>' https://dav.example.com/docs/plan.docx

423, 409 or 403

someone holds a lock; it will work once the lock is released     423 Locked
the request conflicts with the resource's state                  409 Conflict
not allowed, whoever holds what                                  403 Forbidden

In WebDAV, 409 has its own meaning too: MKCOL or PUT into a parent collection that doesn’t exist. Inside a 207 Multi-Status, a 423 can apply to one member of a collection while others succeed.

423 isn’t heuristically cacheable.

Search 423 424 in the tool below to compare it with WebDAV’s Failed Dependency.