DTK0008: Client Auth Disabled

Package: @vitejs/devtools

Message

Client authentication is disabled. Any browser can connect to the devtools and access your server and filesystem.

Cause

This warning is emitted by createWsServer() when the WebSocket server starts and client authentication has been disabled. Authentication is disabled when any of the following conditions is true:

1. The DevTools context is running in build mode (context.mode === 'build').
2. The Vite config sets devtools.config.clientAuth to false.
3. The environment variable VITE_DEVTOOLS_DISABLE_CLIENT_AUTH is set to 'true'.

When authentication is disabled, every connecting WebSocket client is automatically marked as trusted (meta.isTrusted = true), bypassing the token-based auth flow entirely.

Example

import devtools from '@vitejs/devtools'
// vite.config.ts
import { defineConfig } from 'vite'

export default defineConfig({
  plugins: [
    devtools({
      config: {
        // This disables client auth and triggers DTK0008
        clientAuth: false,
      },
    }),
  ],
})

Or via environment variable:

VITE_DEVTOOLS_DISABLE_CLIENT_AUTH=true vite dev

Build mode also disables auth automatically:

vite build  # DTK0008 is logged during build

Fix

This is an informational warning. No action is required if you intentionally disabled authentication (e.g., in a trusted local environment or during builds).

If this warning is unexpected:

• Remove clientAuth: false from your devtools.config in vite.config.ts.
• Unset the VITE_DEVTOOLS_DISABLE_CLIENT_AUTH environment variable.
• If running in build mode, the warning is expected and harmless.

Source

packages/core/src/node/ws.ts