diff --git a/ipn/localapi/localapi.go b/ipn/localapi/localapi.go
index 8bd82c501..8e57f85e1 100644
--- a/ipn/localapi/localapi.go
+++ b/ipn/localapi/localapi.go
@@ -300,8 +300,8 @@ func (h *Handler) serveFiles(w http.ResponseWriter, r *http.Request) {
 }
 
 func (h *Handler) serveFileTargets(w http.ResponseWriter, r *http.Request) {
-	if !h.PermitWrite {
-		http.Error(w, "file access denied", http.StatusForbidden)
+	if !h.PermitRead {
+		http.Error(w, "access denied", http.StatusForbidden)
 		return
 	}
 	if r.Method != "GET" {