fix(ui)!: harden UI API access by hi-ogawa · Pull Request #10583 · vitest-dev/vitest

hi-ogawa · 2026-06-12T07:33:29Z

Description

Closes Harden browser mode and UI API access #10499

As described in v5 breaking change doc, this changes so that Vitest UI now requires authentication for accessing /__vitest__/. First time user authenticates through accessing /__vitest__/?token=..., then middleware check token and persists it as cookie, then later /__vitest__/ access will check that cookie. To make required token stable between vitest invocation, it's now generated once in .local/share/vitest/.vitest-secret-token (and alike on macos and windows).

The rational of the change is that, even though the Vitest API usage is purely for devtools, what's available on the network through localhost:51204/__vitest__/ is immediately RCE (remote code execution) and it's reasonable to protect from arbitrary network access as a basic security posture. In retrospect, if we were to have this (together with #10522), the past vulnerabilities related to API didn't exist.

This is also partly because, intended or not, our security policy frames this way https://github.com/vitest-dev/vitest/blob/main/SECURITY.md#what-vitest-does-not-trust

What Vitest Does Not Trust:
Network data and untrusted clients The integration built on top of Vite's dev server must treat all inbound network requests as potentially hostile. This includes malformed requests. Clients may be outside the developer's intended environment because of port-forwarding, shared networks, or accidental exposure to the internet.

(Not sure yet though if I want to go through all vulnerability patch process. We can say this is a matter of interpretation since we do call out exposing allowExec/allowWrite in non localhost shouldn't be done in documentation.)

TODO

test
docs
cleanup

Example:

Screen.Recording.2026-06-18.at.17.41.03.mov

Please don't delete this checklist! Before submitting the PR, please make sure you do the following:

It's really useful if your PR references an issue where it is discussed ahead of time. If the feature is substantial or introduces breaking changes without a discussion, PR might be closed.
Ideally, include a test that fails without this PR but passes with it.
Please, don't make changes to pnpm-lock.yaml unless you introduce a new test example.
Please check Allow edits by maintainers to make review process faster. Note that this option is not available for repositories that are owned by Github organizations.

Tests

Run the tests with pnpm test:ci.

Documentation

If you introduce new functionality, document it. You can run documentation with pnpm run docs command.

Changesets

Changes in changelog are generated from PR name. Please, make sure that it explains your changes in an understandable manner. Please, prefix changeset messages with feat:, fix:, perf:, docs:, or chore:.

Co-authored-by: Codex <[email protected]>

netlify · 2026-06-12T07:34:44Z

✅ Deploy Preview for vitest-dev ready!

Built without sensitive environment variables

Name	Link
🔨 Latest commit	`760ce21`
🔍 Latest deploy log	https://app.netlify.com/projects/vitest-dev/deploys/6a34bc6cb5bbdf000893344f
😎 Deploy Preview	https://deploy-preview-10583--vitest-dev.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

Co-authored-by: Codex <[email protected]>

hi-ogawa · 2026-06-13T01:06:14Z

Still brainstorming and cookie might indeed work alright. Here is possible flow:

Vitest prints an auth URL once:
UI auth URL: http://localhost:51204/__vitest__/?token=...
Browser/open behavior still targets plain:
http://localhost:51204/__vitest__/
Plain UI without cookie shows a small blocked page:
“Vitest UI is protected. Open the auth URL printed in the terminal to continue.”
Visiting ?token=... validates token, sets an HttpOnly-ish session cookie, then redirects to plain /__vitest__/.
Subsequent access uses cookie, so bookmarks/history/devtools mostly show the clean URL.

AI-Agent: Opencode

When the API token is generated for the first time, no browser holds the auth cookie yet, so open `/__vitest__/?token=...` to authenticate. On subsequent runs, open the clean URL so macOS tab reuse keeps working. AI-Agent: Opencode

`resolveApiToken` now returns the resolved `tokenPath` so the test can target the actual on-disk token file, assert it exists, and confirm the Vite dev server blocks serving it (403). AI-Agent: Opencode

AI-Agent: Opencode

…fix/ui-api-capability-url

Drop the duplicated '.vitest-secret-token' literal in the browser plugin and import the single source of truth from vitest's apiToken module via a relative-src import, keeping the constant internal (no public vitest/node API surface). AI-Agent: Opencode

Rename the constant to reflect it is the token filename, and reuse it when building the token file paths instead of repeating the literal. AI-Agent: Opencode

AI-Agent: Opencode

Replace the hand-rolled cookie parse/serialize with the jshttp `cookie` library (bundled via devDependency). This makes encode/decode symmetric and removes the bespoke parsing. AI-Agent: Opencode

fix: harden UI API capability URL

7369e35

Co-authored-by: Codex <[email protected]>

hi-ogawa changed the title ~~fix(ui)!: validate UI API request~~ fix(ui)!: harden UI API access Jun 12, 2026

hi-ogawa and others added 3 commits June 12, 2026 16:42

Merge branch 'main' into fix/ui-api-capability-url

f740ed2

nit

4d432f2

chore: remove stale UI open TODO

a8cb948

Co-authored-by: Codex <[email protected]>

hi-ogawa and others added 9 commits June 17, 2026 13:47

Merge branch 'main' into fix/ui-api-capability-url

06a7be6

fix(ui): prototype token cookie auth

c31cde8

AI-Agent: Opencode

fix(vitest): store api token in user data

787213b

AI-Agent: Opencode

fix(vitest): fallback api token storage to workspace

dc37709

AI-Agent: Opencode

docs(vitest): reference user data path convention

8cdbf2a

AI-Agent: Opencode

fix(vitest): simplify api token deny pattern

42344f2

AI-Agent: Opencode

fix(ui): open clean ui url

1da9c75

AI-Agent: Opencode

fix(vitest): use uuid api token

0dad832

AI-Agent: Opencode

test(ui): use authenticated ui url

9ce55ec

AI-Agent: Opencode

hi-ogawa added this to Team Board Jun 17, 2026

hi-ogawa added the p2-to-be-discussed Enhancement under consideration (priority) label Jun 17, 2026

hi-ogawa moved this to P2 - 3 in Team Board Jun 17, 2026

hi-ogawa added 10 commits June 17, 2026 16:13

test(ui): cover unauthenticated html access

129c30d

AI-Agent: Opencode

docs: document authenticated ui url

77ad454

AI-Agent: Opencode

docs: mention protected vitest ui access

0f9a8e7

AI-Agent: Opencode

test(ui): cover authenticated direct access

ce743dc

AI-Agent: Opencode

fix(vitest): rely on vite fs deny merge

db954f9

AI-Agent: Opencode

refactor(vitest): inline ui auth url formatting

d5e34dd

AI-Agent: Opencode

fix(browser): append api token deny pattern

aef5534

AI-Agent: Opencode

fix(ui): inject dev api token directly

64dc8ef

AI-Agent: Opencode

nit

9b7460c

docs(vitest): explain clean ui open url for tab reuse

27e1b89

AI-Agent: Opencode

hi-ogawa commented Jun 18, 2026

View reviewed changes

Comment thread test/ui/test/ui.spec.ts

Comment thread packages/vitest/src/node/create.ts

hi-ogawa commented Jun 19, 2026

View reviewed changes

Comment thread packages/browser/src/node/plugin.ts Outdated

hi-ogawa and others added 5 commits June 19, 2026 11:50

test(ui): verify api token file is not served via @fs

fcc42ad

`resolveApiToken` now returns the resolved `tokenPath` so the test can target the actual on-disk token file, assert it exists, and confirm the Vite dev server blocks serving it (403). AI-Agent: Opencode

Merge branch 'main' into fix/ui-api-capability-url

fe906f7

test(e2e): allow tokenCreated in resolved api config shape

d91d4e6

AI-Agent: Opencode

Merge remote-tracking branch 'origin/fix/ui-api-capability-url' into …

2d97529

…fix/ui-api-capability-url

hi-ogawa commented Jun 19, 2026

View reviewed changes

Comment thread packages/ui/node/index.ts Outdated

hi-ogawa commented Jun 19, 2026

View reviewed changes

Comment thread packages/ui/node/index.ts Outdated

hi-ogawa added 3 commits June 19, 2026 12:34

refactor(vitest): rename API_TOKEN_FS_DENY to API_TOKEN_FILE

585668d

Rename the constant to reflect it is the token filename, and reuse it when building the token file paths instead of repeating the literal. AI-Agent: Opencode

fix(ui): clarify unauthenticated ui access error message

1fcd7b9

AI-Agent: Opencode

refactor(ui): use cookie lib for ui auth cookie

760ce21

Replace the hand-rolled cookie parse/serialize with the jshttp `cookie` library (bundled via devDependency). This makes encode/decode symmetric and removes the bespoke parsing. AI-Agent: Opencode

hi-ogawa marked this pull request as ready for review June 19, 2026 03:55

sheremet-va approved these changes Jun 19, 2026

View reviewed changes

sheremet-va merged commit 4c26d76 into vitest-dev:main Jun 19, 2026
15 of 18 checks passed

hi-ogawa deleted the fix/ui-api-capability-url branch June 19, 2026 08:26

hi-ogawa mentioned this pull request Jun 23, 2026

test: relax api token file 403 assertion on windows #10647

Merged

7 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(ui)!: harden UI API access#10583

fix(ui)!: harden UI API access#10583
sheremet-va merged 32 commits into
vitest-dev:mainfrom
hi-ogawa:fix/ui-api-capability-url

hi-ogawa commented Jun 12, 2026 •

edited

Loading

Uh oh!

netlify Bot commented Jun 12, 2026 •

edited

Loading

Uh oh!

hi-ogawa commented Jun 13, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

hi-ogawa commented Jun 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Please don't delete this checklist! Before submitting the PR, please make sure you do the following:

Tests

Documentation

Changesets

Uh oh!

netlify Bot commented Jun 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for vitest-dev ready!

Uh oh!

hi-ogawa commented Jun 13, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

hi-ogawa commented Jun 12, 2026 •

edited

Loading

netlify Bot commented Jun 12, 2026 •

edited

Loading