{"record":{"id":"b29aee26a76943e5","repo":"withastro/astro","slug":"vite-server-fs-strict-has-been-disabled-files","errorCode":null,"errorMessage":"▶ vite.server.fs.strict has been disabled!\n  Files on your machine are likely accessible on your network.","messagePattern":"▶ vite\\.server\\.fs\\.strict has been disabled!\n  Files on your machine are likely accessible on your network\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"packages/astro/src/core/dev/dev.ts","lineNumber":153,"sourceCode":"\n\trestart.bindCLIShortcuts();\n\tlogger.info(\n\t\t'SKIP_FORMAT',\n\t\tmsg.serverStart({\n\t\t\tstartupTime: performance.now() - devStart,\n\t\t\tresolvedUrls: restart.container.viteServer.resolvedUrls || { local: [], network: [] },\n\t\t\thost: restart.container.settings.config.server.host,\n\t\t\tbase: restart.container.settings.config.base,\n\t\t\tastroVersionProvider: new BuildTimeAstroVersionProvider(),\n\t\t\ttextStyler: piccoloreTextStyler,\n\t\t}),\n\t);\n\n\tif (isPrerelease) {\n\t\tlogger.warn('SKIP_FORMAT', msg.prerelease({ currentVersion }));\n\t}\n\tif (restart.container.viteServer.config.server?.fs?.strict === false) {\n\t\tlogger.warn('SKIP_FORMAT', msg.fsStrictWarning());\n\t}\n\n\tlogger.info(null, colors.green('watching for file changes...'));\n\n\treturn {\n\t\taddress: devServerAddressInfo,\n\t\tget resolvedUrls() {\n\t\t\treturn restart.container.viteServer.resolvedUrls || { local: [], network: [] };\n\t\t},\n\t\tget watcher() {\n\t\t\treturn restart.container.viteServer.watcher;\n\t\t},\n\t\thandle(req, res) {\n\t\t\treturn restart.container.handle(req, res);\n\t\t},\n\t\tasync stop() {\n\t\t\tawait restart.container.close();\n\t\t},","sourceCodeStart":135,"sourceCodeEnd":171,"githubUrl":"https://github.com/withastro/astro/blob/e294953aa8aadd98d5be92e60a03037b05dbdfd4/packages/astro/src/core/dev/dev.ts#L135-L171","documentation":"Vite's dev server normally restricts which files it will serve (server.fs.strict). Your config disables that restriction, so any file the process can read — including files outside the project root — becomes fetchable through the dev server; combined with a network-exposed host this can expose your machine's files to the network.","triggerScenarios":"astro.config sets vite: { server: { fs: { strict: false } } } (often to serve files from outside the workspace) while running `astro dev`, especially with --host / server.host binding to 0.0.0.0.","commonSituations":"Monorepo setups importing assets from sibling workspaces outside the project root; copy-pasting 'fix import errors' snippets from the web; sharing a dev server on a shared or public network.","solutions":["Remove fs.strict: false and instead add the extra directories to vite.server.fs.allow","If you must disable strict mode, never combine it with --host or network exposure","Keep any files the dev server needs under the project root"],"exampleFix":"// before — astro.config.mjs\nexport default defineConfig({\n  vite: { server: { fs: { strict: false } } },\n});\n\n// after — allow only the specific extra directory\nexport default defineConfig({\n  vite: { server: { fs: { allow: ['.', '../packages/shared'] } } },\n});","handlingStrategy":"validation","validationCode":"// fail when fs restrictions are relaxed on a network-exposed dev server\nconst vite = config.vite ?? {};\nif (vite.server?.fs?.strict === false && config.server?.host) {\n  throw new Error('fs.strict=false with exposed host risks file disclosure');\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Prefer server.fs.allow lists over disabling strict mode","Never run dev with --host together with fs.strict: false","Run the dev server bound to localhost unless sharing is deliberate"],"tags":["security","vite","dev-server","filesystem"],"backgroundTag":"insecure-filesystem-exposure","analyzedSha":"e294953aa8aadd98d5be92e60a03037b05dbdfd4","analyzedAt":"2026-08-18T18:48:03.901Z","contentChangedAt":"2026-08-18T18:48:03.901Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}