vitest-dev/vitest · error · Error

Cannot modify file " ". File writing is disabled because…

Error message

Cannot modify file "${path}". File writing is disabled because the server is exposed to the internet, see https://vitest.dev/config/browser/api.

What it means

Thrown by assertBrowserApiWrite when either project.config.api.allowWrite or project.vitest.config.api.allowWrite is false. This is a deliberate security guard: when the browser API server could be exposed to the internet, file writes from the browser UI are blocked to prevent remote code/asset tampering.

Solutions

If on a trusted/private network, set test.api.allowWrite: true explicitly in config after confirming the listener is not publicly reachable.
Bind the API/UI to loopback (api.host: '127.0.0.1') so the default posture stays safe and writes are not gated.
Do not enable allowWrite when the server is exposed — restructure so writes happen on the developer's machine instead.

Example fix

// before: server exposed, writes blocked
export default defineConfig({ test: { api: { port: 51204 } } })
// after: trusted loopback, writes allowed
export default defineConfig({ test: { api: { host: '127.0.0.1', port: 51204, allowWrite: true } } })

Defensive patterns

Strategy: validation

Validate before calling

// Ensure writes are only attempted when the API is configured for them.
function canWriteFromBrowser(cfg) {
  return cfg.test?.api?.allowWrite === true && cfg.test?.api?.host !== '0.0.0.0'
}

Prevention

Default the browser API/UI to loopback (api.host: '127.0.0.1').
Only enable api.allowWrite on trusted, non-public networks.
Never expose the browser UI to the internet with allowWrite enabled.

When it happens

Trigger: assertBrowserApiWrite(project, path) is invoked by a browser-API write operation (e.g. updating a snapshot or file from the UI) and either allowWrite flag is falsy.

Common situations: Running the browser UI on a host reachable from the internet (api.host not loopback) where allowWrite defaults off; a CI dashboard exposing the UI publicly; wanting to edit tests from the browser panel in such a setup.

Related errors

AI-assisted analysis of vitest-dev/vitest@1fa9837ec2 (2026-08-11). Data as JSON: /api/errors/6ea467508a0c2996. Report an issue: GitHub.

Appendix: source

Thrown at packages/browser/src/node/utils.ts:114

export function slash(path: string): string {
  return path.replace(/\\/g, '/').replace(/\/+/g, '/')
}

export function assertBrowserFileAccess(project: TestProject, path: string): void {
  const normalized = slash(path)
  if (
    !isFileLoadingAllowed(project.vite.config, normalized)
    && !isFileLoadingAllowed(project.vitest.vite.config, normalized)
  ) {
    throw new Error(
      `Access denied to "${path}". See Vite config documentation for "server.fs": https://vitejs.dev/config/server-options.html#server-fs-strict.`,
    )
  }
}

export function assertBrowserApiWrite(project: TestProject, path: string): void {
  if (!project.config.api.allowWrite || !project.vitest.config.api.allowWrite) {
    throw new Error(
      `Cannot modify file "${path}". File writing is disabled because the server is exposed to the internet, see https://vitest.dev/config/browser/api.`,
    )
  }
}

View on GitHub (pinned to 1fa9837ec2)