{"id":"85492aabb21e1b0c","repo":"vitest-dev/vitest","slug":"access-denied-to-path-see-vite-config-docume-85492a","errorCode":null,"errorMessage":"Access denied to \"${path}\". See Vite config documentation for \"server.fs\": https://vitejs.dev/config/server-options.html#server-fs-strict.","messagePattern":"Access denied to \"(.+?)\"\\. See Vite config documentation for \"server\\.fs\": https://vitejs\\.dev/config/server-options\\.html#server-fs-strict\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/browser/src/node/utils.ts","lineNumber":106,"sourceCode":"    )\n  }\n  if (typeof options.provider.providerFactory !== 'function') {\n    throw new TypeError(`The \"${name}\" browser provider does not provide a \"providerFactory\" function. Received ${typeof options.provider.providerFactory}.`)\n  }\n  return options.provider.providerFactory(project)\n}\n\nexport function slash(path: string): string {\n  return path.replace(/\\\\/g, '/').replace(/\\/+/g, '/')\n}\n\nexport function assertBrowserFileAccess(project: TestProject, path: string): void {\n  const normalized = slash(path)\n  if (\n    !isFileLoadingAllowed(project.vite.config, normalized)\n    && !isFileLoadingAllowed(project.vitest.vite.config, normalized)\n  ) {\n    throw new Error(\n      `Access denied to \"${path}\". See Vite config documentation for \"server.fs\": https://vitejs.dev/config/server-options.html#server-fs-strict.`,\n    )\n  }\n}\n\nexport function assertBrowserApiWrite(project: TestProject, path: string): void {\n  if (!project.config.api.allowWrite || !project.vitest.config.api.allowWrite) {\n    throw new Error(\n      `Cannot modify file \"${path}\". File writing is disabled because the server is exposed to the internet, see https://vitest.dev/config/browser/api.`,\n    )\n  }\n}\n","sourceCodeStart":88,"sourceCodeEnd":119,"githubUrl":"https://github.com/vitest-dev/vitest/blob/d568f8ce3739b532d5bf2c1ee1e45e8a8a473d09/packages/browser/src/node/utils.ts#L88-L119","documentation":"Thrown by assertBrowserFileAccess() when Vite's isFileLoadingAllowed returns false for both the project Vite config and the main Vitest Vite config. This is Vitest delegating to Vite's server.fs.allow / server.fs.strict security boundary to prevent browser commands from reading files outside allowed roots.","triggerScenarios":"Calling a browser fs command (readFile, writeFile, _fileInfo, or screenshot file access) on a path that is not within the Vite-allowed filesystem roots. The path is normalized via slash() and checked against both Vite server configs.","commonSituations":"Tests reading fixture files located outside the project root; monorepo where the test file references a sibling package outside server.fs.allow; strict fs mode defaulting on after a Vite/Vitest upgrade; absolute paths to /tmp or home.","solutions":["Add the directory to server.fs.allow in your Vite/Vitest config, e.g. server: { fs: { allow: ['/abs/path'] } }.","Move fixture files inside the project root so they fall under the default allowed root.","Disable server.fs.strict only if you understand the security implications."],"exampleFix":"// before\nexport default defineConfig({\n  test: {\n    browser: { enabled: true },\n    // readFile('/shared/fixtures/data.json') fails — outside root\n  },\n})\n// after\nexport default defineConfig({\n  server: { fs: { allow: ['/shared/fixtures'] } },\n  test: { browser: { enabled: true } },\n})","handlingStrategy":"validation","validationCode":"import { isFileLoadingAllowed } from 'vitest/node'\n// before a browser fs command\nconst allowed = isFileLoadingAllowed(viteConfig, slash(resolve(root, path)))\nif (!allowed) throw new Error(`Path outside server.fs.allow: ${path}`)","typeGuard":null,"tryCatchPattern":"try {\n  await readFile(path)\n} catch (e) {\n  if (/Access denied/i.test(String((e as Error).message))) {\n    // surface a config hint\n    throw new Error(`Add '${dirOf(path)}' to server.fs.allow`)\n  }\n  throw e\n}","preventionTips":["Keep fixtures inside the project root so default fs.allow covers them.","Whitelist extra roots explicitly via server.fs.allow rather than disabling strict mode.","Resolve all browser file paths relative to project.config.root."],"tags":["browser-mode","filesystem","vite","security","config"],"analyzedSha":"d568f8ce3739b532d5bf2c1ee1e45e8a8a473d09","analyzedAt":"2026-08-03T20:23:56.861Z","schemaVersion":2}