How to deny access to .git folder with server.fs.deny

[viac92]

Hi everybody,

I don't understand how to deny access to all elements in the .git folder, in particular to .git/logs/HEAD file.

I used the StackBliz to understand the server.fs.deny setting.

I created a new file vite.config.js and add the following code:

import { defineConfig, searchForWorkspaceRoot } from 'vite'

export default defineConfig({
  server: {
    fs: {
      deny: [
        searchForWorkspaceRoot(process.cwd()),
        ".git",
        ".env"
      ]
    }
  }
})

then I added an .env and .git/logs/HEAD file in the root.

And it worked like charm, and if I navigate to the /.env or /.git address I get the correct answer from the server:

403 Restricted
The request url "/home/projects/vitejs-vite-1gpml7/.git" is outside of Vite serving allow list.

- /home/projects/vitejs-vite-1gpml7

Refer to docs https://vitejs.dev/config/server-options.html#server-fs-allow for configurations and more details.

So tried to add all the folders or a specific file in the .git folder in all this way but nothing worked

import { defineConfig, searchForWorkspaceRoot } from 'vite'

export default defineConfig({
  server: {
    fs: {
      deny: [
        searchForWorkspaceRoot(process.cwd()),
        ".git",
        ".env",
        //no working config
        ".git/logs/HEAD",
        "/.git/logs/HEAD",
        ".git/**/**",
        "/.git/**/**",
        // add answer from Shyam-Chen
        "./.git/**"
      ]
    }
  }
})

My final goal is to deny the access to all the files and folders of .git or at least to the HEAD file that contains sensible data about the commits.

EDIT:
I share with you my StackBlitz session so it's easier to test.

[Shyam-Chen]

'./.git/**'

[viac92]

Not working

[phaethon]

**/.git/**

[patak-dev]

this is also added by default to the deny list in Vite 6