403 when loading a file from an external package if base is set #9438
Description
Describe the bug
I am trying to create a module for tools/components I have, in order to import them in my vue application, using vite.
To test that locally, I just installed the plugin into my app with the command npm install ../plugin.
Then, in my app, I'm just referencing the method like this:
import { sayHello } from 'plugin'
sayHello();This works well with vite, but then I am in the situation where my vue app is integrated in a bigger app, and is served under /app instead of the root.
So I edited my vite.config.js like this:
/** @type {import('vite').UserConfig} */
export default {
base: '/app/'
}Then, the browser fails to download the file from the plugin with a 403. See the logs below.
Workaround : disable server.fs.strict mode:
/** @type {import('vite').UserConfig} */
export default {
base: '/app/',
server: {
fs: {
strict: false
}
}
}Reproduction
https://github.com/jeremyVignelles/repro-vite
System Info
System:
OS: Windows 10 10.0.19044
CPU: (8) x64 Intel(R) Core(TM) i7-6920HQ CPU @ 2.90GHz
Memory: 12.03 GB / 23.89 GB
Binaries:
Node: 16.11.1 - C:\Program Files\nodejs\node.EXE
Yarn: 1.22.10 - ~\AppData\Roaming\npm\yarn.CMD
npm: 7.19.0 - C:\Program Files\nodejs\npm.CMD
Browsers:
Edge: Spartan (44.19041.1266.0), Chromium (97.0.1072.76)
Internet Explorer: 11.0.19041.1566
npmPackages:
vite: ^3.0.0 => 3.0.4Used Package Manager
npm
Logs
Click to expand!
$ npx vite -d
vite:config bundled config file loaded in 34.91ms +0ms
vite:config using resolved config: {
vite:config base: '/app/',
vite:config optimizeDeps: {
vite:config disabled: 'build',
vite:config force: undefined,
vite:config esbuildOptions: { preserveSymlinks: undefined }
vite:config },
vite:config server: {
vite:config preTransformRequests: true,
vite:config middlewareMode: false,
vite:config fs: { strict: true, allow: [Array], deny: [Array] }
vite:config },
vite:config configFile: 'D:/Projects/Tests/repro-vite/vite-project/vite.config.js',
vite:config configFileDependencies: [ 'D:/Projects/Tests/repro-vite/vite-project/vite.config.js' ],
vite:config inlineConfig: {
vite:config root: undefined,
vite:config base: undefined,
vite:config mode: undefined,
vite:config configFile: undefined,
vite:config logLevel: undefined,
vite:config clearScreen: undefined,
vite:config optimizeDeps: { force: undefined },
vite:config server: {}
vite:config },
vite:config root: 'D:/Projects/Tests/repro-vite/vite-project',
vite:config resolve: { alias: [ [Object], [Object] ] },
vite:config publicDir: 'D:\\Projects\\Tests\\repro-vite\\vite-project\\public',
vite:config cacheDir: 'D:\\Projects\\Tests\\repro-vite\\vite-project\\node_modules\\.vite',
vite:config command: 'serve',
vite:config mode: 'development',
vite:config ssr: {
vite:config format: 'esm',
vite:config target: 'node',
vite:config optimizeDeps: { disabled: true, esbuildOptions: [Object] }
vite:config },
vite:config isWorker: false,
vite:config mainConfig: null,
vite:config isProduction: false,
vite:config plugins: [
vite:config 'vite:pre-alias',
vite:config 'alias',
vite:config 'vite:modulepreload-polyfill',
vite:config 'vite:optimized-deps',
vite:config 'vite:resolve',
vite:config 'vite:html-inline-proxy',
vite:config 'vite:css',
vite:config 'vite:esbuild',
vite:config 'vite:json',
vite:config 'vite:wasm-helper',
vite:config 'vite:worker',
vite:config 'vite:asset',
vite:config 'vite:wasm-fallback',
vite:config 'vite:define',
vite:config 'vite:css-post',
vite:config 'vite:worker-import-meta-url',
vite:config 'vite:dynamic-import-vars',
vite:config 'vite:import-glob',
vite:config 'vite:client-inject',
vite:config 'vite:import-analysis'
vite:config ],
vite:config build: {
vite:config target: [ 'es2020', 'edge88', 'firefox78', 'chrome87', 'safari13' ],
vite:config polyfillModulePreload: true,
vite:config outDir: 'dist',
vite:config assetsDir: 'assets',
vite:config assetsInlineLimit: 4096,
vite:config cssCodeSplit: true,
vite:config cssTarget: [ 'es2020', 'edge88', 'firefox78', 'chrome87', 'safari13' ],
vite:config sourcemap: false,
vite:config rollupOptions: {},
vite:config minify: 'esbuild',
vite:config terserOptions: {},
vite:config write: true,
vite:config emptyOutDir: null,
vite:config manifest: false,
vite:config lib: false,
vite:config ssr: false,
vite:config ssrManifest: false,
vite:config reportCompressedSize: true,
vite:config chunkSizeWarningLimit: 500,
vite:config watch: null,
vite:config commonjsOptions: { include: [Array], extensions: [Array] },
vite:config dynamicImportVarsOptions: { warnOnError: true, exclude: [Array] }
vite:config },
vite:config preview: {
vite:config port: undefined,
vite:config strictPort: undefined,
vite:config host: undefined,
vite:config https: undefined,
vite:config open: undefined,
vite:config proxy: undefined,
vite:config cors: undefined,
vite:config headers: undefined
vite:config },
vite:config env: { BASE_URL: '/app/', MODE: 'development', DEV: true, PROD: false },
vite:config assetsInclude: [Function: assetsInclude],
vite:config logger: {
vite:config hasWarned: false,
vite:config info: [Function: info],
vite:config warn: [Function: warn],
vite:config warnOnce: [Function: warnOnce],
vite:config error: [Function: error],
vite:config clearScreen: [Function: clearScreen],
vite:config hasErrorLogged: [Function: hasErrorLogged]
vite:config },
vite:config packageCache: Map(0) {},
vite:config createResolver: [Function: createResolver],
vite:config worker: {
vite:config format: 'iife',
vite:config plugins: [
vite:config [Object], [Object], [Object],
vite:config [Object], [Object], [Object],
vite:config [Object], [Object], [Object],
vite:config [Object], [Object], [Object],
vite:config [Object], [Object], [Object],
vite:config [Object], [Object], [Object],
vite:config [Object], [Object]
vite:config ],
vite:config rollupOptions: {}
vite:config },
vite:config appType: 'spa',
vite:config experimental: { importGlobRestoreExtension: false, hmrPartialAccept: false }
vite:config } +14ms
vite:deps Hash is consistent. Skipping. Use --force to override. +0ms
VITE v3.0.4 ready in 292 ms
➜ Local: http://127.0.0.1:5173/app/
➜ Network: use --host to expose
vite:spa-fallback Rewriting GET / to /index.html +0ms
vite:time 27.51ms /index.html +0ms
vite:spa-fallback Rewriting GET / to /index.html +48ms
vite:time 8.06ms /index.html +30ms
vite:resolve 31.36ms D:\Projects\Tests\repro-vite\vite-project\node_modules\vite\dist\client\client.mjs -> D:/Projects/Tests/repro-vite/vite-project/node_modules/vite/dist/client/client.mjs +0ms
vite:resolve 34.66ms /@vite/client -> D:/Projects/Tests/repro-vite/vite-project/node_modules/vite/dist/client/client.mjs +1ms
vite:resolve 2.29ms /main.js -> D:/Projects/Tests/repro-vite/vite-project/main.js +29ms
vite:load 16.07ms [fs] /@vite/client +0ms
vite:load 26.71ms [fs] /main.js +24ms
vite:resolve 5.09ms plugin -> D:/Projects/Tests/repro-vite/plugin/lib.js +43ms
vite:import-analysis 7.63ms [1 imports rewritten] main.js +0ms
vite:transform 12.05ms /main.js +0ms
vite:time 51.41ms /main.js +142ms
vite:resolve 1.01ms D:\Projects\Tests\repro-vite\vite-project\node_modules\vite\dist\client\env.mjs -> D:/Projects/Tests/repro-vite/vite-project/node_modules/vite/dist/client/env.mjs +15ms
vite:resolve 1.55ms @vite/env -> D:/Projects/Tests/repro-vite/vite-project/node_modules/vite/dist/client/env.mjs +1ms
vite:resolve 0.93ms /node_modules/vite/dist/client/env.mjs -> D:/Projects/Tests/repro-vite/vite-project/node_modules/vite/dist/client/env.mjs +1ms
vite:import-analysis 8.87ms [1 imports rewritten] node_modules\vite\dist\client\client.mjs +17ms
vite:transform 35.55ms /@vite/client +17ms
vite:time 133.22ms /@vite/client +21ms
The request url "D:/Projects/Tests/repro-vite/plugin/lib.js" is outside of Vite serving allow list.
- D:/Projects/Tests/repro-vite/vite-project
Refer to docs https://vitejs.dev/config/server-options.html#server-fs-allow for configurations and more details.
vite:time 11.87ms ..\plugin\lib.js +18ms
vite:load 21.15ms [fs] /node_modules/vite/dist/client/env.mjs +62ms
vite:import-analysis 4.53ms [no imports] node_modules\vite\dist\client\env.mjs +40ms
vite:transform 8.42ms /node_modules/vite/dist/client/env.mjs +39ms
vite:time 15.62ms /node_modules/vite/dist/client/env.mjs +17ms
vite:time 8.97ms /vite.svg +32ms
vite:deps ✨ static imports crawl ended +540msValidations
- Follow our Code of Conduct
- Read the Contributing Guidelines.
- Read the docs.
- Check that there isn't already an issue that reports the same bug to avoid creating a duplicate.
- Make sure this is a Vite issue and not a framework-specific issue. For example, if it's a Vue SFC related bug, it should likely be reported to vuejs/core instead.
- Check that this is a concrete bug. For Q&A open a GitHub Discussion or join our Discord Chat Server.
- The provided reproduction is a minimal reproducible example of the bug.