{"record":{"id":"85492aabb21e1b0c","repo":"vitest-dev/vitest","slug":"access-denied-to-path-see-vite-config-docume-85492a","errorCode":null,"errorMessage":"Access denied to \"${path}\". See Vite config documentation for \"server.fs\": https://vitejs.dev/config/server-options.html#server-fs-strict.","messagePattern":"Access denied to \"(.+?)\"\\. See Vite config documentation for \"server\\.fs\": https://vitejs\\.dev/config/server-options\\.html#server-fs-strict\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/browser/src/node/utils.ts","lineNumber":106,"sourceCode":"    )\n  }\n  if (typeof options.provider.providerFactory !== 'function') {\n    throw new TypeError(`The \"${name}\" browser provider does not provide a \"providerFactory\" function. Received ${typeof options.provider.providerFactory}.`)\n  }\n  return options.provider.providerFactory(project)\n}\n\nexport function slash(path: string): string {\n  return path.replace(/\\\\/g, '/').replace(/\\/+/g, '/')\n}\n\nexport function assertBrowserFileAccess(project: TestProject, path: string): void {\n  const normalized = slash(path)\n  if (\n    !isFileLoadingAllowed(project.vite.config, normalized)\n    && !isFileLoadingAllowed(project.vitest.vite.config, normalized)\n  ) {\n    throw new Error(\n      `Access denied to \"${path}\". See Vite config documentation for \"server.fs\": https://vitejs.dev/config/server-options.html#server-fs-strict.`,\n    )\n  }\n}\n\nexport function assertBrowserApiWrite(project: TestProject, path: string): void {\n  if (!project.config.api.allowWrite || !project.vitest.config.api.allowWrite) {\n    throw new Error(\n      `Cannot modify file \"${path}\". File writing is disabled because the server is exposed to the internet, see https://vitest.dev/config/browser/api.`,\n    )\n  }\n}\n","sourceCodeStart":88,"sourceCodeEnd":119,"githubUrl":"https://github.com/vitest-dev/vitest/blob/1fa9837ec26533512fdcad8baebf249771bd340a/packages/browser/src/node/utils.ts#L88-L119","documentation":"Thrown by assertBrowserFileAccess when neither the project's own Vite server config nor the Vitest root Vite server config permits loading the given path under server.fs.allow. This is Vite's filesystem-strict guard surfacing inside browser mode, where the page may try to fetch arbitrary files.","triggerScenarios":"assertBrowserFileAccess(project, path) is called for a file the browser client wants to read, and isFileLoadingAllowed returns false for both project.vite.config and project.vitest.vite.config.","commonSituations":"server.fs.strict is on (default in newer Vite) and the file lives outside the workspace root; a symlinked dependency or monorepo sibling package not in the allow list; a test referencing an absolute path to /tmp or /etc.","solutions":["Add the directory containing the file to server.fs.allow in your vite/vitest config (e.g. allow: ['..', '../shared']).","Move the file inside the project workspace root so it falls under the default allow scope.","If intentional and trusted, set server.fs.strict: false (weaker security — prefer widening allow instead)."],"exampleFix":"// before\nexport default defineConfig({})\n// after\nexport default defineConfig({\n  server: { fs: { allow: [searchForWorkspaceRoot(__dirname), '../shared-assets'] } },\n})","handlingStrategy":"validation","validationCode":"// Validate paths you hand to the browser are within an allowed root before requesting them.\nimport { isAbsolute, relative } from 'node:path'\nfunction assertWithinRoots(filePath, roots) {\n  const norm = isAbsolute(filePath) ? filePath : resolve(filePath)\n  const ok = roots.some(r => !relative(r, norm).startsWith('..'))\n  if (!ok) throw new Error(`${filePath} is outside server.fs.allow roots`)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Set server.fs.allow to include all directories the browser may read (workspace root, monorepo siblings, symlinked deps).","Avoid loading absolute paths from outside the project in browser tests.","Keep server.fs.strict on and widen allow rather than disabling strict."],"tags":["browser","filesystem","vite-config","security"],"backgroundTag":null,"analyzedSha":"1fa9837ec26533512fdcad8baebf249771bd340a","analyzedAt":"2026-08-11T16:11:39.638Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}