[vite] Internal server error: The request url "/api" is outside of vite dev server root

[vfilatov]

Describe the bug
After updating to Vite v2.3.0 I receive the following error:
[vite] Internal server error: The request url "/api" is outside of vite dev server root "/tmp/bug". For security concerns, accessing files outside of workspace root is restricted since Vite v2.3.x. Refer to docs https://vitejs.dev/config/#server-fsserveroot for configurations and more details.

To Reproduce

mkdir /tmp/bug && cd /tmp/bug
npm init svelte@next # all defaults
npm install
mkdir src/routes/api
cat <<EOF > src/routes/api/index.js
export async function get () {
  return {
    body: "World"
  }
}
EOF

cat <<EOF > src/routes/bug.svelte
<script>
import { onMount } from 'svelte';

let name;
onMount(async () => {
  const resp = await fetch("/api");
  name = await resp.text();
})
</script>

Hello, { name }
EOF

run server npm run dev navigate browser to http://localhost:3000/bug

observe error on the console

      For security concerns, accessing files outside of workspace root is restricted since Vite v2.3.x. 
      Refer to docs https://vitejs.dev/config/#server-fsserveroot for configurations and more details.
      at ensureServingAccess (/tmp/bug/node_modules/vite/dist/node/chunks/dep-c9ea388d.js:57841:15)
      at transformRequest (/tmp/bug/node_modules/vite/dist/node/chunks/dep-c9ea388d.js:57883:17)
      at processTicksAndRejections (internal/process/task_queues.js:93:5)
      at async viteTransformMiddleware (/tmp/bug/node_modules/vite/dist/node/chunks/dep-c9ea388d.js:58069:32) (x4)

Expected behavior
not having such error

[Conduitry]

There are a couple of issues opened directly on the Vite repo currently that all seem to be about this. There's one PR vitejs/vite#3350 open for it that I have not looked at. In the meantime, we're considering pinning Kit to Vite 2.2.

edit: It sounds like that's just for fixing an issue on Windows. There are other cross-platform issues present that have issues on Vite's tracker, which are probably all different facets of the same thing.

[JustinVoitel]

I tried several cases and renaming the endpoint from index.ts to index.json.ts and calling fetch("/api.json") solved the issue for me.

[dominikg]

that check has been disabled by default in vite 2.3.1, so if you are seeing this issue, please update

[wiesson]

that check has been disabled by default in vite 2.3.1, so if you are seeing this issue, please update

Btw, it looks like that 1.0.0-next.105 does not include the pinning to Vite version 2.2.4 - could you release that as well? (Or bump it directly to 2.3.1) - In my case, I always get 2.3.0 :(

[dominikg]

#1429

[wiesson]

Hmm, maybe something is wrong with my setup, but I still see this error (in development). I also tried to add

fsServe: {
  strict: false,
},

[ignatiusmb]

I can't reproduce with the latest version, no errors are being logged in the console anymore.