vitest-dev/vitest · error · Error

Access denied to " ". See Vite config documentation for…

Error message

Access denied to "${path}". See Vite config documentation for "server.fs": https://vitejs.dev/config/server-options.html#server-fs-strict.

What it means

checkFileAccess calls Vite's isFileLoadingAllowed against the resolved vite config and throws when the path falls outside every allowed root. Vite's server.fs.strict mode (default true) restricts file access to files within server.fs.allow (default: the project workspace root and search-up workspace roots). This is the same guard Vite applies to /@fs/ imports.

Solutions

Keep all browser-accessed files (snapshots, screenshots, fixtures) inside the project root.
If you need access outside the root, add the directory to server.fs.allow in your vite/vitest config.
Disable server.fs.strict only as a last resort and never on a network-exposed server.
Resolve symlinks before passing paths, and ensure the realpath is within an allowed root.

Example fix

// before
export default defineConfig({ test: { server: { fs: { strict: true } } } })
// path outside root -> access denied
// after
export default defineConfig({ test: { server: { fs: { allow: [workspaceRoot, '/data/snapshots'] } } } })

Defensive patterns

Strategy: validation

Validate before calling

import { isFileLoadingAllowed } from 'vite'
function pathAllowed(viteConfig: any, path: string): boolean {
  return isFileLoadingAllowed(viteConfig, path)
}

Prevention

Keep browser-accessed files inside the project root.
Extend server.fs.allow explicitly rather than disabling server.fs.strict.
Resolve symlinks before checking access.

When it happens

Trigger: Any browser RPC that reads/writes a file (readFile, writeFile, snapshot operations, screenshot reads) with a path outside server.fs.allow: an absolute path in /tmp, a file in a sibling monorepo package not in the allow list, or a symlink that escapes the allow root.

Common situations: Storing snapshots/screenshots outside the project (e.g. a shared /tmp dir); monorepo where one package's tests reference another package outside the search-up workspace roots; running with a custom root that excludes the file; symlinks that resolve outside the allow list.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of vitest-dev/vitest@1fa9837ec2 (2026-08-11). Data as JSON: /api/errors/d73f83e8d6dd5b75. Report an issue: GitHub.

Appendix: source

Thrown at packages/browser/src/node/rpc.ts:120

          sessions.destroySession(sessionId)
        }
        // this will reject any hanging methods if there are any
        rpc.$close(
          new Error(`[vitest] Browser connection was closed while running tests. Was the page closed unexpectedly?`),
        )
      })
    })
  })

  // we don't throw an error inside a stream because this can segfault the process
  function error(err: Error) {
    console.error(err)
    vitest.state.catchError(err, 'RPC Error')
  }

  function checkFileAccess(path: string) {
    if (!isFileLoadingAllowed(vite.config, path)) {
      throw new Error(
        `Access denied to "${path}". See Vite config documentation for "server.fs": https://vitejs.dev/config/server-options.html#server-fs-strict.`,
      )
    }
  }

  function canWrite(project: TestProject) {
    return (
      project.config.api.allowWrite
      && project.vitest.config.api.allowWrite
    )
  }

  function isCdpAllowed(project: TestProject) {
    return (
      project.config.api.allowExec
      && project.vitest.config.api.allowExec
      && project.config.api.allowWrite
      && project.vitest.config.api.allowWrite

View on GitHub (pinned to 1fa9837ec2)