vitejs
diff --git a/‎packages/playground/fs-serve/__tests__/fs-serve.spec.ts
Lines changed: 7 additions & 1 deletion b/‎packages/playground/fs-serve/__tests__/fs-serve.spec.ts
Lines changed: 7 additions & 1 deletion
diff --git a/‎packages/playground/fs-serve/root/src/index.html
Lines changed: 11 additions & 1 deletion b/‎packages/playground/fs-serve/root/src/index.html
Lines changed: 11 additions & 1 deletion
diff --git a/‎packages/vite/src/node/server/middlewares/static.ts
Lines changed: 1 addition & 1 deletion b/‎packages/vite/src/node/server/middlewares/static.ts
Lines changed: 1 addition & 1 deletion
@@ -97,7 +97,13 @@ describe('main', () => {
     })
 
     test('denied', async () => {
-      expect(await page.textContent('.unsafe-dotenv')).toBe('404')
+      expect(await page.textContent('.unsafe-dotenv')).toBe('403')
+    })
+
+    test('denied EnV casing', async () => {
+      // It is 403 in case insensitive system, 404 in others
+      const code = await page.textContent('.unsafe-dotEnV-casing')
+      expect(code === '403' || code === '404').toBeTruthy()
     })
   } else {
     test('dummy test to make jest happy', async () => {
 
@@ -45,6 +45,7 @@ <h2>Nested Entry</h2>
 
 <h2>Denied</h2>
 <pre class="unsafe-dotenv"></pre>
+<pre class="unsafe-dotEnV-casing"></pre>
 
 <script type="module">
   import '../../entry'
@@ -202,14 +203,23 @@ <h2>Denied</h2>
     })
 
   // .env, denied by default
-  fetch('/@fs/' + ROOT + '/root/.env')
+  fetch('/@fs/' + ROOT + '/root/src/.env')
     .then((r) => {
       text('.unsafe-dotenv', r.status)
     })
     .catch((e) => {
       console.error(e)
     })
 
+  // .env, for case insensitive file systems
+  fetch('/@fs/' + ROOT + '/root/src/.EnV')
+    .then((r) => {
+      text('.unsafe-dotEnV-casing', r.status)
+    })
+    .catch((e) => {
+      console.error(e)
+    })
+
   function text(sel, text) {
     document.querySelector(sel).textContent = text
   }
 
@@ -156,7 +156,7 @@ export function serveRawFsMiddleware(
   }
 }
 
-const _matchOptions = { matchBase: true }
+const _matchOptions = { matchBase: true, nocase: true }
 
 export function isFileServingAllowed(
   url: string,