diff --git a/platform/built-in-server/src/org/jetbrains/builtInWebServer/DefaultWebServerPathHandler.kt b/platform/built-in-server/src/org/jetbrains/builtInWebServer/DefaultWebServerPathHandler.kt
index 2876c923e9bd..f3b93dceabb6 100644
--- a/platform/built-in-server/src/org/jetbrains/builtInWebServer/DefaultWebServerPathHandler.kt
+++ b/platform/built-in-server/src/org/jetbrains/builtInWebServer/DefaultWebServerPathHandler.kt
@@ -139,7 +139,8 @@ private fun checkAccess(pathInfo: PathInfo, channel: Channel, request: HttpReque
       HttpResponseStatus.FORBIDDEN.orInSafeMode(HttpResponseStatus.NOT_FOUND).send(channel, request)
       return false
     }
-    else if (!checkAccess(file, Paths.get(pathInfo.root.path))) {
+    else if (!hasAccess(file)) {
+      // we check only file, but all directories in the path because of https://youtrack.jetbrains.com/issue/WEB-21594
       HttpResponseStatus.FORBIDDEN.orInSafeMode(HttpResponseStatus.NOT_FOUND).send(channel, request)
       return false
     }
diff --git a/platform/built-in-server/src/org/jetbrains/builtInWebServer/StaticFileHandler.kt b/platform/built-in-server/src/org/jetbrains/builtInWebServer/StaticFileHandler.kt
index 457e39c19f5b..b8325a0a26ac 100644
--- a/platform/built-in-server/src/org/jetbrains/builtInWebServer/StaticFileHandler.kt
+++ b/platform/built-in-server/src/org/jetbrains/builtInWebServer/StaticFileHandler.kt
@@ -105,4 +105,4 @@ internal fun checkAccess(file: Path, root: Path = file.root): Boolean {
 }
 
 // deny access to any dot prefixed file
-private fun hasAccess(result: Path) = Files.isReadable(result) && !(Files.isHidden(result) || result.fileName.toString().startsWith('.'))
\ No newline at end of file
+internal fun hasAccess(result: Path) = Files.isReadable(result) && !(Files.isHidden(result) || result.fileName.toString().startsWith('.'))
\ No newline at end of file
diff --git a/platform/built-in-server/testSrc/BuiltInServerTestCase.kt b/platform/built-in-server/testSrc/BuiltInServerTestCase.kt
index b30634beb5a4..1e84816f1801 100644
--- a/platform/built-in-server/testSrc/BuiltInServerTestCase.kt
+++ b/platform/built-in-server/testSrc/BuiltInServerTestCase.kt
@@ -55,6 +55,7 @@ internal abstract class BuiltInServerTestCase {
 
 internal fun testUrl(url: String, expectedStatus: HttpResponseStatus): HttpURLConnection {
   val connection = URL(url).openConnection() as HttpURLConnection
+  BuiltInServerManager.getInstance().configureRequestToWebServer(connection)
   assertThat(HttpResponseStatus.valueOf(connection.responseCode)).isEqualTo(expectedStatus)
   return connection
 }
\ No newline at end of file
diff --git a/platform/built-in-server/testSrc/BuiltInWebServerTest.kt b/platform/built-in-server/testSrc/BuiltInWebServerTest.kt
index d457fac331be..7ec80123d0de 100644
--- a/platform/built-in-server/testSrc/BuiltInWebServerTest.kt
+++ b/platform/built-in-server/testSrc/BuiltInWebServerTest.kt
@@ -93,7 +93,7 @@ internal class HeavyBuiltInWebServerTest {
   }
 
   @Test
-  fun `hidden dir`() {
+  fun `file in hidden folder`() {
     val projectDir = tempDirManager.newPath().resolve("foo/bar")
     val projectDirPath = projectDir.systemIndependentPath
     createHeavyProject("$projectDirPath/test.ipr").use { project ->
@@ -101,15 +101,15 @@ internal class HeavyBuiltInWebServerTest {
       LocalFileSystem.getInstance().refreshAndFindFileByPath(projectDirPath)
       createModule(projectDirPath, project)
 
-      val dir = projectDir.resolve(".doNotExposeMe")
+      val dir = projectDir.resolve(".coverage")
       if (SystemInfo.isWindows) {
         Files.setAttribute(dir, "dos:hidden", true)
       }
 
-      val path = dir.resolve("foo").write("doNotExposeMe").systemIndependentPath
+      val path = dir.resolve("foo").write("exposeMe").systemIndependentPath
       val relativePath = FileUtil.getRelativePath(project.basePath!!, path, '/')
       val webPath = StringUtil.replace(UrlEscapers.urlPathSegmentEscaper().escape("${project.name}/$relativePath"), "%2F", "/")
-      testUrl("http://localhost:${BuiltInServerManager.getInstance().port}/$webPath", HttpResponseStatus.FORBIDDEN)
+      testUrl("http://localhost:${BuiltInServerManager.getInstance().port}/$webPath", HttpResponseStatus.OK)
     }
   }
 }
\ No newline at end of file