diff --git a/chfs-ng/internal/api/server.go b/chfs-ng/internal/api/server.go
index 66115b4..0fd9736 100644
--- a/chfs-ng/internal/api/server.go
+++ b/chfs-ng/internal/api/server.go
@@ -1073,8 +1073,15 @@ type webdavAuthFS struct {
 	account *auth.Account
 }
 
+func webdavAuthPath(p string) string {
+	p = strings.Trim(strings.ReplaceAll(p, "\\", "/"), "/")
+	p = strings.TrimPrefix(p, "webdav/")
+	p = strings.TrimPrefix(p, "webdav")
+	return strings.Trim(p, "/")
+}
+
 func (f *webdavAuthFS) allow(path string, p auth.PermMask) error {
-	path = strings.Trim(path, "/")
+	path = webdavAuthPath(path)
 	if f.account == nil || f.account.MaskFor(path)&p != p {
 		return webdav.NewHTTPError(http.StatusForbidden, fmt.Errorf("forbidden"))
 	}
@@ -1145,7 +1152,7 @@ func (f *webdavAuthFS) Copy(ctx context.Context, name, dest string, opts *webdav
 	if err := f.checkTree(ctx, name, auth.Read); err != nil {
 		return false, err
 	}
-	parent := path.Dir(strings.Trim(dest, "/"))
+	parent := path.Dir(webdavAuthPath(dest))
 	if parent == "." {
 		parent = ""
 	}
@@ -1161,7 +1168,7 @@ func (f *webdavAuthFS) Move(ctx context.Context, name, dest string, opts *webdav
 	if err := f.checkTree(ctx, name, auth.Delete); err != nil {
 		return false, err
 	}
-	parent := path.Dir(strings.Trim(dest, "/"))
+	parent := path.Dir(webdavAuthPath(dest))
 	if parent == "." {
 		parent = ""
 	}