HTTP status code · Client errors (4xx)
423 Locked
423 Locked means the resource you tried to modify, or its destination, holds a WebDAV lock you did not present a token for. The usual cause is another user or a crashed client that opened the file for editing and still holds the lock.
| Class | 4xx, Client errors |
|---|---|
| Defined in | RFC 4918 §11.3 |
| Cacheable by default | Only with explicit Cache-Control or Expires |
| Safe to retry | Yes, once the lock is released or expires, or right away if you hold the lock token |
| Relevant headers |
|
What 423 means
RFC 4918, section 11.3, defines 423 for the source or destination of a method being locked, and says the body should carry a precondition code such as lock-token-submitted or no-conflicting-lock. Office apps editing files on SharePoint, Nextcloud or ownCloud take exclusive write locks with the LOCK method so that two people do not overwrite each other.
Locks carry a timeout, so a stale lock from a closed laptop usually clears on its own. Until then, PUT, MOVE, DELETE and PROPPATCH on that file answer 423.
Common causes
If you are visiting the site
- A colleague has the document open in Word or Excel through a synced folder or network drive.
- Your own editor crashed or lost connection while the file was open, leaving its lock behind.
If you run the server
- A WebDAV client sends PUT or MOVE without the If header carrying the lock token it received from LOCK.
- Lock timeouts set very long (or Infinite), so abandoned locks never expire.
How to fix it
If you are visiting the site
- Ask whoever has the file open to close it, or wait for the lock timeout to pass.
- In Nextcloud, an admin can clear stuck locks (occ files:scan, or the files_lock app if it is installed); in SharePoint, closing the file on every device releases it.
If you run the server
- Make the client keep the Lock-Token from the LOCK response and send it back as If: (<token>) on every write.
- Use finite lock timeouts, measured in minutes, and let clients refresh them while the file stays open.
How to send 423
app.put('/files/:name', (req, res) => {
res.status(423).json({ error: 'File is locked by another client' });
});// app/files/[name]/route.ts
export async function PUT() {
return Response.json(
{ error: 'File is locked by another client' },
{ status: 423 }
);
}mux.HandleFunc("PUT /files/{name}", func(w http.ResponseWriter, r *http.Request) {
w.Header().Set("Content-Type", "application/json")
w.WriteHeader(http.StatusLocked) // 423
w.Write([]byte(`{"error":"File is locked by another client"}`))
})from fastapi import FastAPI, HTTPException
app = FastAPI()
@app.put("/files/{name}")
def put_file(name: str):
raise HTTPException(status_code=423, detail="File is locked by another client")Commonly confused with
- 423 vs 409
- 409 is a general conflict with the resource state; 423 names the specific reason, an active lock held by someone else.
- 423 vs 403
- 403 is permanent for your credentials; 423 goes away when the lock is released, with the same credentials.
Frequently asked questions
- How long does a WebDAV lock last?
- As long as the timeout the client asked for in the LOCK request and the server accepted, often a few minutes to an hour. Clients refresh it while the file is open; once they stop, the lock expires and 423 responses stop.
- Can I get 423 outside WebDAV?
- Some REST APIs borrow 423 for records that are locked for editing or accounts that are temporarily locked, but that use is informal. The registered meaning is the WebDAV one from RFC 4918.
- Is 423 the same as the file being read-only?
- No. A read-only file is refused with 403 for everyone at all times. A 423 lock belongs to one holder and ends when that holder unlocks or the timeout runs out.
Last reviewed by Arielton Oberek.