403 when loading a file from an external package if base is set

[jeremyVignelles]

Describe the bug

I am trying to create a module for tools/components I have, in order to import them in my vue application, using vite.

To test that locally, I just installed the plugin into my app with the command npm install ../plugin.

Then, in my app, I'm just referencing the method like this:

import { sayHello } from 'plugin'

sayHello();

This works well with vite, but then I am in the situation where my vue app is integrated in a bigger app, and is served under /app instead of the root.

So I edited my vite.config.js like this:

/** @type {import('vite').UserConfig} */
export default {
    base: '/app/'
}

Then, the browser fails to download the file from the plugin with a 403. See the logs below.

Workaround : disable server.fs.strict mode:

/** @type {import('vite').UserConfig} */
export default {
    base: '/app/',
    server: {
        fs: {
            strict: false
        }
    }
}

Reproduction

https://github.com/jeremyVignelles/repro-vite

System Info

System:
    OS: Windows 10 10.0.19044
    CPU: (8) x64 Intel(R) Core(TM) i7-6920HQ CPU @ 2.90GHz
    Memory: 12.03 GB / 23.89 GB
  Binaries:
    Node: 16.11.1 - C:\Program Files\nodejs\node.EXE
    Yarn: 1.22.10 - ~\AppData\Roaming\npm\yarn.CMD
    npm: 7.19.0 - C:\Program Files\nodejs\npm.CMD
  Browsers:
    Edge: Spartan (44.19041.1266.0), Chromium (97.0.1072.76)
    Internet Explorer: 11.0.19041.1566
  npmPackages:
    vite: ^3.0.0 => 3.0.4

Used Package Manager

npm

Logs

Click to expand!

$ npx vite -d
  vite:config bundled config file loaded in 34.91ms +0ms
  vite:config using resolved config: {
  vite:config   base: '/app/',
  vite:config   optimizeDeps: {
  vite:config     disabled: 'build',
  vite:config     force: undefined,
  vite:config     esbuildOptions: { preserveSymlinks: undefined }
  vite:config   },
  vite:config   server: {
  vite:config     preTransformRequests: true,
  vite:config     middlewareMode: false,
  vite:config     fs: { strict: true, allow: [Array], deny: [Array] }
  vite:config   },
  vite:config   configFile: 'D:/Projects/Tests/repro-vite/vite-project/vite.config.js',
  vite:config   configFileDependencies: [ 'D:/Projects/Tests/repro-vite/vite-project/vite.config.js' ],
  vite:config   inlineConfig: {
  vite:config     root: undefined,
  vite:config     base: undefined,
  vite:config     mode: undefined,
  vite:config     configFile: undefined,
  vite:config     logLevel: undefined,
  vite:config     clearScreen: undefined,
  vite:config     optimizeDeps: { force: undefined },
  vite:config     server: {}
  vite:config   },
  vite:config   root: 'D:/Projects/Tests/repro-vite/vite-project',
  vite:config   resolve: { alias: [ [Object], [Object] ] },
  vite:config   publicDir: 'D:\\Projects\\Tests\\repro-vite\\vite-project\\public',
  vite:config   cacheDir: 'D:\\Projects\\Tests\\repro-vite\\vite-project\\node_modules\\.vite',
  vite:config   command: 'serve',
  vite:config   mode: 'development',
  vite:config   ssr: {
  vite:config     format: 'esm',
  vite:config     target: 'node',
  vite:config     optimizeDeps: { disabled: true, esbuildOptions: [Object] }
  vite:config   },
  vite:config   isWorker: false,
  vite:config   mainConfig: null,
  vite:config   isProduction: false,
  vite:config   plugins: [
  vite:config     'vite:pre-alias',
  vite:config     'alias',
  vite:config     'vite:modulepreload-polyfill',
  vite:config     'vite:optimized-deps',
  vite:config     'vite:resolve',
  vite:config     'vite:html-inline-proxy',
  vite:config     'vite:css',
  vite:config     'vite:esbuild',
  vite:config     'vite:json',
  vite:config     'vite:wasm-helper',
  vite:config     'vite:worker',
  vite:config     'vite:asset',
  vite:config     'vite:wasm-fallback',
  vite:config     'vite:define',
  vite:config     'vite:css-post',
  vite:config     'vite:worker-import-meta-url',
  vite:config     'vite:dynamic-import-vars',
  vite:config     'vite:import-glob',
  vite:config     'vite:client-inject',
  vite:config     'vite:import-analysis'
  vite:config   ],
  vite:config   build: {
  vite:config     target: [ 'es2020', 'edge88', 'firefox78', 'chrome87', 'safari13' ],
  vite:config     polyfillModulePreload: true,
  vite:config     outDir: 'dist',
  vite:config     assetsDir: 'assets',
  vite:config     assetsInlineLimit: 4096,
  vite:config     cssCodeSplit: true,
  vite:config     cssTarget: [ 'es2020', 'edge88', 'firefox78', 'chrome87', 'safari13' ],
  vite:config     sourcemap: false,
  vite:config     rollupOptions: {},
  vite:config     minify: 'esbuild',
  vite:config     terserOptions: {},
  vite:config     write: true,
  vite:config     emptyOutDir: null,
  vite:config     manifest: false,
  vite:config     lib: false,
  vite:config     ssr: false,
  vite:config     ssrManifest: false,
  vite:config     reportCompressedSize: true,
  vite:config     chunkSizeWarningLimit: 500,
  vite:config     watch: null,
  vite:config     commonjsOptions: { include: [Array], extensions: [Array] },
  vite:config     dynamicImportVarsOptions: { warnOnError: true, exclude: [Array] }
  vite:config   },
  vite:config   preview: {
  vite:config     port: undefined,
  vite:config     strictPort: undefined,
  vite:config     host: undefined,
  vite:config     https: undefined,
  vite:config     open: undefined,
  vite:config     proxy: undefined,
  vite:config     cors: undefined,
  vite:config     headers: undefined
  vite:config   },
  vite:config   env: { BASE_URL: '/app/', MODE: 'development', DEV: true, PROD: false },
  vite:config   assetsInclude: [Function: assetsInclude],
  vite:config   logger: {
  vite:config     hasWarned: false,
  vite:config     info: [Function: info],
  vite:config     warn: [Function: warn],
  vite:config     warnOnce: [Function: warnOnce],
  vite:config     error: [Function: error],
  vite:config     clearScreen: [Function: clearScreen],
  vite:config     hasErrorLogged: [Function: hasErrorLogged]
  vite:config   },
  vite:config   packageCache: Map(0) {},
  vite:config   createResolver: [Function: createResolver],
  vite:config   worker: {
  vite:config     format: 'iife',
  vite:config     plugins: [
  vite:config       [Object], [Object], [Object],
  vite:config       [Object], [Object], [Object],
  vite:config       [Object], [Object], [Object],
  vite:config       [Object], [Object], [Object],
  vite:config       [Object], [Object], [Object],
  vite:config       [Object], [Object], [Object],
  vite:config       [Object], [Object]
  vite:config     ],
  vite:config     rollupOptions: {}
  vite:config   },
  vite:config   appType: 'spa',
  vite:config   experimental: { importGlobRestoreExtension: false, hmrPartialAccept: false }
  vite:config } +14ms
  vite:deps Hash is consistent. Skipping. Use --force to override. +0ms

  VITE v3.0.4  ready in 292 ms

  ➜  Local:   http://127.0.0.1:5173/app/
  ➜  Network: use --host to expose
  vite:spa-fallback Rewriting GET / to /index.html +0ms
  vite:time 27.51ms /index.html +0ms
  vite:spa-fallback Rewriting GET / to /index.html +48ms
  vite:time 8.06ms /index.html +30ms
  vite:resolve 31.36ms D:\Projects\Tests\repro-vite\vite-project\node_modules\vite\dist\client\client.mjs -> D:/Projects/Tests/repro-vite/vite-project/node_modules/vite/dist/client/client.mjs +0ms
  vite:resolve 34.66ms /@vite/client -> D:/Projects/Tests/repro-vite/vite-project/node_modules/vite/dist/client/client.mjs +1ms
  vite:resolve 2.29ms /main.js -> D:/Projects/Tests/repro-vite/vite-project/main.js +29ms
  vite:load 16.07ms [fs] /@vite/client +0ms
  vite:load 26.71ms [fs] /main.js +24ms
  vite:resolve 5.09ms plugin -> D:/Projects/Tests/repro-vite/plugin/lib.js +43ms
  vite:import-analysis 7.63ms [1 imports rewritten] main.js +0ms
  vite:transform 12.05ms /main.js +0ms
  vite:time 51.41ms /main.js +142ms
  vite:resolve 1.01ms D:\Projects\Tests\repro-vite\vite-project\node_modules\vite\dist\client\env.mjs -> D:/Projects/Tests/repro-vite/vite-project/node_modules/vite/dist/client/env.mjs +15ms
  vite:resolve 1.55ms @vite/env -> D:/Projects/Tests/repro-vite/vite-project/node_modules/vite/dist/client/env.mjs +1ms
  vite:resolve 0.93ms /node_modules/vite/dist/client/env.mjs -> D:/Projects/Tests/repro-vite/vite-project/node_modules/vite/dist/client/env.mjs +1ms
  vite:import-analysis 8.87ms [1 imports rewritten] node_modules\vite\dist\client\client.mjs +17ms
  vite:transform 35.55ms /@vite/client +17ms
  vite:time 133.22ms /@vite/client +21ms
The request url "D:/Projects/Tests/repro-vite/plugin/lib.js" is outside of Vite serving allow list.

- D:/Projects/Tests/repro-vite/vite-project

Refer to docs https://vitejs.dev/config/server-options.html#server-fs-allow for configurations and more details.

  vite:time 11.87ms ..\plugin\lib.js +18ms
  vite:load 21.15ms [fs] /node_modules/vite/dist/client/env.mjs +62ms
  vite:import-analysis 4.53ms [no imports] node_modules\vite\dist\client\env.mjs +40ms
  vite:transform 8.42ms /node_modules/vite/dist/client/env.mjs +39ms
  vite:time 15.62ms /node_modules/vite/dist/client/env.mjs +17ms
  vite:time 8.97ms /vite.svg +32ms
  vite:deps ✨ static imports crawl ended +540ms

Validations

• Follow our Code of Conduct
• Read the Contributing Guidelines.
• Read the docs.
• Check that there isn't already an issue that reports the same bug to avoid creating a duplicate.
• Make sure this is a Vite issue and not a framework-specific issue. For example, if it's a Vue SFC related bug, it should likely be reported to vuejs/core instead.
• Check that this is a concrete bug. For Q&A open a GitHub Discussion or join our Discord Chat Server.
• The provided reproduction is a minimal reproducible example of the bug.

[lislon]

Same issue here. I'm running vite under nx project, and the app is references other libraries in siblings directories.

When I specify with base parameter, vite complains when I try to load library outside

Root URL works fine:

GET http://localhost:3049/@fs/C:/Users/ele/src/my-project/apps/my-app/index.ts
200

But when I try to load library, I got:

GET  http://localhost:3049/@fs/C:/Users/ele/src/my-project/libs/shared/util-migration/src/index.ts
403

403 Restricted
The request url "C:/Users/ele/src/my-project/libs/shared/util-migration/src/index.ts" is outside of Vite serving allow list.

- C:/Users/ele/src/my-project/apps/my-app
- C:/Users/ele/src/my-project/node_modules/vite

Refer to docs https://vitejs.dev/config/server-options.html#server-fs-allow for configurations and more details.

Debugging showed that vite collects a list of safeModulesPath

vite/packages/vite/src/node/plugins/importAnalysis.ts

Line 513 in f3ab3b0

server?.moduleGraph.safeModulesPath.add(fsPathFromUrl(url))

When base is NOT set, the safeModulesPath looks like this:

4 = "/src/index.scss" {value: "/src/index.scss"}
5 = "/src/App.tsx" {value: "/src/App.tsx"}
6 = "/src/reportWebVitals.ts" {value: "/src/reportWebVitals.ts"}
7 = "C:/Users/ele/src/my-project/libs/shared/util-migration/src/index.ts" {value: "C:/Users/ele/src/my-project/libs/shared/util-migration/src/index.ts"}

When base is set, the safeModulesPath looks differently:

4 = "/my-base/src/index.scss" {value: "/my-base/src/index.scss"}
5 = "/my-base/src/App.tsx" {value: "/my-base/src/App.tsx"}
6 = "/my-base/src/reportWebVitals.ts" {value: "/my-base/src/reportWebVitals.ts"}
7 = "/my-base/@fs/C:/Users/ele/src/my-project/libs/shared/util-migration/src/index.ts" {value: "/my-base/@fs/C:/Users/ele/src/my-project/libs/shared/util-migration/src/index.ts"}

Note that element [7] has now @fs prefix inside.

This is the reason of why this check will not work when base is set:

The file contains value like "C:/Users/ele/src/my-project/libs/shared/util-migration/src/index.ts" which not matches with element [7]: "/my-base/@fs/C:/Users/ele/src/my-project/libs/shared/util-migration/src/index.ts"

vite/packages/vite/src/node/server/middlewares/static.ts

Line 190 in f3ab3b0

if (server.moduleGraph.safeModulesPath.has(file)) return true

[sapphi-red]

@lislon That's a great finding. I think we need to call stripBase in utils.ts before passing to fsPathFromUrl.

[JesusTheHun]

Hello @sapphi-red, do you think you can schedule this for a near release ? This really f* us.
@jeremyVignelles did you find a workaround ?

[jeremyVignelles]

It seems like I didn't. i don't remember, it's been a while, but I think I was forced to go another way...