vitest-dev/vitest · error · Error

Access denied to " ". See Vite config documentation for…

Error message

Access denied to "${path}". See Vite config documentation for "server.fs": https://vitejs.dev/config/server-options.html#server-fs-strict.

What it means

Thrown by assertBrowserFileAccess when neither the project's own Vite server config nor the Vitest root Vite server config permits loading the given path under server.fs.allow. This is Vite's filesystem-strict guard surfacing inside browser mode, where the page may try to fetch arbitrary files.

Solutions

1. Add the directory containing the file to server.fs.allow in your vite/vitest config (e.g. allow: ['..', '../shared']).
2. Move the file inside the project workspace root so it falls under the default allow scope.
3. If intentional and trusted, set server.fs.strict: false (weaker security — prefer widening allow instead).

Example fix

// before
export default defineConfig({})
// after
export default defineConfig({
  server: { fs: { allow: [searchForWorkspaceRoot(__dirname), '../shared-assets'] } },
})

// Validate paths you hand to the browser are within an allowed root before requesting them.
import { isAbsolute, relative } from 'node:path'
function assertWithinRoots(filePath, roots) {
  const norm = isAbsolute(filePath) ? filePath : resolve(filePath)
  const ok = roots.some(r => !relative(r, norm).startsWith('..'))
  if (!ok) throw new Error(`${filePath} is outside server.fs.allow roots`)
}

When it happens

Trigger: assertBrowserFileAccess(project, path) is called for a file the browser client wants to read, and isFileLoadingAllowed returns false for both project.vite.config and project.vitest.vite.config.

Common situations: server.fs.strict is on (default in newer Vite) and the file lives outside the workspace root; a symlinked dependency or monorepo sibling package not in the allow list; a test referencing an absolute path to /tmp or /etc.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Access denied to " ". See Vite config documentation for…
• Cannot modify file " ". File writing is disabled because…
• Cannot use CDP because browser API write or exec operations…
• Couldn't write file to fs
• provider is not supported

AI-assisted analysis of vitest-dev/vitest@1fa9837ec2 (2026-08-11). Data as JSON: /api/errors/85492aabb21e1b0c. Report an issue: GitHub.

Appendix: source

Thrown at packages/browser/src/node/utils.ts:106

    )
  }
  if (typeof options.provider.providerFactory !== 'function') {
    throw new TypeError(`The "${name}" browser provider does not provide a "providerFactory" function. Received ${typeof options.provider.providerFactory}.`)
  }
  return options.provider.providerFactory(project)
}

export function slash(path: string): string {
  return path.replace(/\\/g, '/').replace(/\/+/g, '/')
}

export function assertBrowserFileAccess(project: TestProject, path: string): void {
  const normalized = slash(path)
  if (
    !isFileLoadingAllowed(project.vite.config, normalized)
    && !isFileLoadingAllowed(project.vitest.vite.config, normalized)
  ) {
    throw new Error(
      `Access denied to "${path}". See Vite config documentation for "server.fs": https://vitejs.dev/config/server-options.html#server-fs-strict.`,
    )
  }
}

export function assertBrowserApiWrite(project: TestProject, path: string): void {
  if (!project.config.api.allowWrite || !project.vitest.config.api.allowWrite) {
    throw new Error(
      `Cannot modify file "${path}". File writing is disabled because the server is exposed to the internet, see https://vitest.dev/config/browser/api.`,
    )
  }
}

View on GitHub (pinned to 1fa9837ec2)