Incorrect date-time format used in WebDAV: RFC 1123 instead of RFC 2616

[Opisek]

Issue Description

Stalwart includes non-standard-compliant timestamps in its WebDAV properties.

I first encountered the bug when it was reported to me that the value Mon, 9 Feb 2026 21:37:40 GMT was supplied to my application via Stalwart's CalDAV implementation, which throws an error on my side.

The getlastmodified property in WebDAV is standardized in RFC 4918 15.7 to be the RFC 2616 3.3.1 format. This is the same as RFC 1123 5.2.14 with the crucial constraint that the date be a fixed-length subset of the RFC 1123 format. This is then formalized using ABNF as follows:

HTTP-date    = rfc1123-date | rfc850-date | asctime-date
   rfc1123-date = wkday "," SP date1 SP time SP "GMT"
    rfc850-date  = weekday "," SP date2 SP time SP "GMT"
    asctime-date = wkday SP date3 SP time SP 4DIGIT
    date1        = 2DIGIT SP month SP 4DIGIT    
               ; day month year (e.g., 02 Jun 1982)
    date2        = 2DIGIT "-" month "-" 2DIGIT
                   ; day-month-year (e.g., 02-Jun-82)
    date3        = month SP ( 2DIGIT | ( SP 1DIGIT ))
                   ; month day (e.g., Jun  2)
    time         = 2DIGIT ":" 2DIGIT ":" 2DIGIT
                   ; 00:00:00 - 23:59:59
    wkday        = "Mon" | "Tue" | "Wed"
                 | "Thu" | "Fri" | "Sat" | "Sun"
    weekday      = "Monday" | "Tuesday" | "Wednesday"
                 | "Thursday" | "Friday" | "Saturday" | "Sunday"
    month        = "Jan" | "Feb" | "Mar" | "Apr"
                 | "May" | "Jun" | "Jul" | "Aug"
                 | "Sep" | "Oct" | "Nov" | "Dec"

The relevant part is date1, which explicitly states that the day value be given using two digits. Naming these non-terminals "rfc1123-date" is misleading, but not formally incorrect. This is what "rfc1123-date" in RFC 4918 15.7 refers to, which I believe is where the issue originated. If one were to use the original RFC 1123 5.2.14 (which is equivalent to RFC 822 5.1 apart from allowing for more than two digits to be used for the year), one would obtain the following language:

date-time   =  [ day "," ] date time        ; dd mm yy
                                                 ;  hh:mm:ss zzz
     
     day         =  "Mon"  / "Tue" /  "Wed"  / "Thu"
                 /  "Fri"  / "Sat" /  "Sun"
     
     date        =  1*2DIGIT month 2*4DIGIT      ; day month year
                                                 ;  e.g. 20 Jun 82
     
     month       =  "Jan"  /  "Feb" /  "Mar"  /  "Apr"
                 /  "May"  /  "Jun" /  "Jul"  /  "Aug"
                 /  "Sep"  /  "Oct" /  "Nov"  /  "Dec"
     
     time        =  hour zone                    ; ANSI and Military
     
     hour        =  2DIGIT ":" 2DIGIT [":" 2DIGIT]
                                                 ; 00:00:00 - 23:59:59
     
     zone        =  "UT"  / "GMT"                ; Universal Time
                                                 ; North American : UT
                 /  "EST" / "EDT"                ;  Eastern:  - 5/ - 4
                 /  "CST" / "CDT"                ;  Central:  - 6/ - 5
                 /  "MST" / "MDT"                ;  Mountain: - 7/ - 6
                 /  "PST" / "PDT"                ;  Pacific:  - 8/ - 7
                 /  1ALPHA                       ; Military: Z = UT;
                                                 ;  A:-1; (J not used)
                                                 ;  M:-12; N:+1; Y:+12
                 / ( ("+" / "-") 4DIGIT )        ; Local differential
                                                 ;  hours+min. (HHMM)

The important part is date = 1*2DIGIT month 2*4DIGIT, which—as per RFC 5234—means that the day and year can use a variable amount of digits. Again, this is not what the WebDAV specification says.

Expected Behavior

The RFC 2616 3.3.1 date-time format is used in WebDAV properties.

Actual Behavior

The RFC 1123 3.3.1 date-time format is used in WebDAV properties.

Reproduction Steps

Relevant Log Output

-

Stalwart Version

v0.15.x

Installation Method

Docker

Database Backend

RocksDB

Blob Storage

RocksDB

Search Engine

Internal

Directory Backend

Internal

Additional Context

I don't have the deployment details of the original issue report's Stalwart setup, but I found the culprit in the source code of Stalwart.

1. WebDavProperty::GetLastModified uses Rfc1123DateTime: Permalink
2. Rfc1123DateTime uses a variable amount of digits for the day: Permalink

I'm tagging the person who reported the issue to me in case you still need some details about their Stalwart setup @hadleyrich

I acknowledge that:

• I have reviewed the documentation and FAQ and confirm that my issue is NOT addressed there.
• I have searched the Stalwart repository (both open and closed Discussions and Issues) and confirm this is not a duplicate.
• I have set the logging level to trace and included relevant log output if applicable.
• I agree to follow the project's Code of Conduct.

[hadleyrich]

Thank you very much @Opisek for raising this. I was the OP of the bug in Luna which turns out not to be a bug, just a strict standards follow by the Go stdlib.

In case it's relevant, my installation details are;

Stalwart EE 0.15.5
Docker installation
PostgreSQL data store
PostgreSQL search store
Valkey in-memory store
Internal directory
S3 Blob store

Happy to provide any trace logs or other details if they would be helpful.