The request url [file path here] is outside of Vite serving allow list.

[DariuszOstolski]

Command

serve

Is this a regression?

• [X] Yes, this behavior used to work in the previous version

The previous version in which this bug was not present was

16

Description

I've just migrated to Angular v17 and vite+esbuild my Angular application.

I have following configuration for application assets:

  "builder": "@angular-devkit/build-angular:application",
      "options": {
        "outputPath": "../public",
        "index": "projects/memc-rs/src/index.html",
        "browser": "projects/memc-rs/src/main.ts",
        "polyfills": [
          "projects/memc-rs/src/polyfills.ts"
        ],
        "tsConfig": "projects/memc-rs/tsconfig.app.json",
        "inlineStyleLanguage": "scss",
        "assets": [
          "projects/memc-rs/src/favicon.ico",
          "projects/memc-rs/src/sitemap.xml",
          "projects/memc-rs/src/robots.txt",
          "projects/memc-rs/src/assets",
          { "input": "../api", "glob": "**/*", "output": "./api" }
        ],
        "styles": [
          "projects/memc-rs/src/styles.scss",
          "./node_modules/animate.css/animate.min.css",
          "./node_modules/prismjs/themes/prism-tomorrow.min.css",
          "./node_modules/prismjs/plugins/command-line/prism-command-line.min.css"
        ],
        "scripts": [
          "node_modules/marked/marked.min.js",
          "node_modules/prismjs/prism.js",
          "node_modules/prismjs/components/prism-shell-session.min.js",
          "node_modules/prismjs/plugins/command-line/prism-command-line.min.js",
          "./node_modules/emoji-toolkit/lib/js/joypixels.min.js"
        ]
      },

With previous version of angular(webpack) I could start dev server and under /api I've got resources from ../api folder. With vite+esbuild I have following errors on console:

➜ Local: http://localhost:35093/ The request url "/home/darostol/projects/memc-rs-web/api/docs/index.md" is outside of Vite serving allow list.

The file path is correct:

    ls - /home/darostol/projects/memc-rs-web/api/docs/index.md
    /home/darostol/projects/memc-rs-web/api/docs/index.md

It just seems that vite configuration doesn't allow it to be served.

Minimal Reproduction

npm run-script start

Exception or Error

Initial Chunk Files          | Names            |  Raw Size
scripts.js                   | scripts          | 602.53 kB | 
styles.css                   | styles           | 197.49 kB | 
polyfills.js                 | polyfills        |  83.57 kB | 
chunk-RPPPXHQ7.js            | -                |  34.89 kB | 
main.js                      | main             |   8.41 kB | 

                             | Initial Total    | 926.90 kB

Lazy Chunk Files             | Names            |  Raw Size
home-page.module-FNKB4QJB.js | home-page-module |  27.42 kB | 
blog.module-5PJYBIP2.js      | blog-module      |   6.66 kB | 
download.module-2FN37KB5.js  | download-module  |   6.34 kB | 
docs.module-CRPRTEUZ.js      | docs-module      |   2.97 kB | 

Application bundle generation complete. [2.135 seconds]
Watch mode enabled. Watching for file changes...
  ➜  Local:   http://localhost:35093/
The request url "/home/darostol/projects/memc-rs-web/api/docs/index.md" is outside of Vite serving allow list.

- /home/darostol/projects/memc-rs-web/client-workspace

Refer to docs https://vitejs.dev/config/server-options.html#server-fs-allow for configurations and more details.

The request url "/home/darostol/projects/memc-rs-web/api/docs/index.md" is outside of Vite serving allow list.
The request url "/home/darostol/projects/memc-rs-web/api/docs/index.md" is outside of Vite serving allow list. (x2)

Your Environment

❯ ng version          

     _                      _                 ____ _     ___
    / \   _ __   __ _ _   _| | __ _ _ __     / ___| |   |_ _|
   / △ \ | '_ \ / _` | | | | |/ _` | '__|   | |   | |    | |
  / ___ \| | | | (_| | |_| | | (_| | |      | |___| |___ | |
 /_/   \_\_| |_|\__, |\__,_|_|\__,_|_|       \____|_____|___|
                |___/

Angular CLI: 17.0.1
Node: 18.13.0
Package Manager: npm 8.19.3
OS: linux x64

Angular: 17.0.3
... animations, common, compiler, compiler-cli, core, forms
... platform-browser, platform-browser-dynamic, platform-server
... router

Package                         Version
---------------------------------------------------------
@angular-devkit/architect       0.1700.1 (cli-only)
@angular-devkit/build-angular   17.0.1
@angular-devkit/core            17.0.1 (cli-only)
@angular-devkit/schematics      17.0.1
@angular/cli                    17.0.1
@angular/ssr                    17.0.1
@schematics/angular             17.0.1
ng-packagr                      17.0.1
rxjs                            7.8.1
typescript                      5.2.2
zone.js                         0.14.2

Anything else relevant?

No response

[clydin]

The problem appears to be caused by the asset configuration, specifically:

{ "input": "../api", "glob": "**/*", "output": "./api" }

This configuration is referencing files outside of the workspace root which the Vite-based dev server currently does not allow. However, it should be possible for us to adjust the Vite server to ensure that all configured assets are allowed during server initialization.

[angular-automatic-lock-bot[bot]]

This issue has been automatically locked due to inactivity. Please file a new issue if you are encountering a similar or related problem.

Read more about our automatic conversation locking policy.

_{This action has been performed automatically by a bot.}