Network permissions (--allow-net) in Deno

Introduction

Deno restricts network access by default to keep your computer safe. You use --allow-net to let your program connect to the internet or other computers.

When your program needs to fetch data from a website.

When your app connects to a database over the network.

When you want to run a server that listens for incoming requests.

When you need to call APIs on the internet.

When testing network features locally or remotely.

Syntax

Deno

deno run --allow-net your_script.ts

Note: You can specify domains like --allow-net=example.com

You can allow all network access with --allow-net or restrict it to specific domains like --allow-net=example.com.

Without this flag, Deno will block any network requests to keep your system safe.

Examples

Allows all network access for the script.

Deno

deno run --allow-net script.ts

Allows network access only to deno.land domain.

Deno

deno run --allow-net=deno.land script.ts

No network access allowed; network calls will fail.

Deno

deno run script.ts

Sample Program

This simple server listens on port 8000 and responds with a greeting. You must run it with --allow-net so it can open the network port.

Deno

import { serve } from "https://deno.land/std@0.201.0/http/server.ts";

const server = serve({ port: 8000 });
console.log("Server running on http://localhost:8000/");

for await (const req of server) {
  req.respond({ body: "Hello from Deno!" });
}

Important Notes

Always grant the least permissions needed for safety.

Use domain restrictions to limit network access when possible.

If you forget --allow-net, your program will throw a permission error when trying to access the network.

Summary

--allow-net lets your Deno program use the network safely.

You can allow all or specific domains for network access.

Without it, network calls will be blocked to protect your computer.

Practice

1. What does the --allow-net flag do when running a Deno program?

easy

A. It allows the program to access the network.

B. It disables all network access for the program.

C. It grants permission to read local files.

D. It enables debugging mode for the program.

Solution

1. Step 1: Understand the purpose of --allow-net

   This flag is used to grant network access to a Deno program, which is otherwise restricted for security.

2. Step 2: Compare options with the flag's function

   Only "It allows the program to access the network." correctly states that --allow-net allows network access. Other options describe unrelated permissions or features.

3. Final Answer:

   It allows the program to access the network. -> Option A

4. Quick Check:

   Network permission = Allow network access [OK]

Hint: Remember: --allow-net means allow network access [OK]

Common Mistakes:

• Confusing --allow-net with file permissions
• Thinking it disables network access
• Mixing it up with debugging flags

2. Which of the following is the correct way to allow network access only to example.com when running a Deno script named app.ts?

easy

A. deno run app.ts --allow-net=example.com

B. deno run --allow-net app.ts example.com

C. deno run --allow-net=example.com app.ts

D. deno run --allow-net example.com app.ts

Solution

1. Step 1: Identify correct flag syntax for domain restriction

   The correct syntax is --allow-net=domain placed before the script name.

2. Step 2: Check command order and placement

   deno run --allow-net=example.com app.ts correctly places --allow-net=example.com before app.ts. Other options have incorrect order or syntax.

3. Final Answer:

   deno run --allow-net=example.com app.ts -> Option C

4. Quick Check:

   Correct flag syntax = deno run --allow-net=example.com app.ts [OK]

Hint: Put --allow-net=domain before script name [OK]

Common Mistakes:

• Placing domain after script name
• Using space instead of '=' between flag and domain
• Putting script name before flags

3. Consider this Deno command and script:

deno run --allow-net=deno.land app.ts

And app.ts contains:

const response = await fetch('https://deno.land/std/http/file_server.ts');
console.log(response.status);

What will be the output?

medium

A. SyntaxError

B. PermissionDenied: network access to "deno.land" is not allowed

C. 404

D. 200

Solution

1. Step 1: Check network permission for the domain

   The command allows network access only to "deno.land", which matches the fetch URL domain.

2. Step 2: Understand fetch behavior with permission

   Since permission is granted, fetch succeeds and returns HTTP status 200 for a valid resource.

3. Final Answer:

   200 -> Option D

4. Quick Check:

   Allowed domain fetch = 200 status [OK]

Hint: Allowed domain fetch returns 200 status [OK]

Common Mistakes:

• Assuming permission error despite allowed domain
• Confusing 404 with permission issues
• Expecting syntax errors from fetch

4. You run this command:

deno run --allow-net=example.com app.ts

Inside app.ts you fetch https://google.com. What error will you get?

medium

A. PermissionDenied: network access to "google.com" is not allowed

B. No error, fetch succeeds

C. TypeError: Invalid URL

D. ReferenceError: fetch is not defined

Solution

1. Step 1: Analyze allowed domains

   The command only allows network access to "example.com" but the script tries to fetch "google.com".

2. Step 2: Understand Deno's permission enforcement

   Deno blocks network requests to domains not allowed, causing a PermissionDenied error.

3. Final Answer:

   PermissionDenied: network access to "google.com" is not allowed -> Option A

4. Quick Check:

   Disallowed domain fetch = PermissionDenied error [OK]

Hint: Fetch outside allowed domain causes PermissionDenied [OK]

Common Mistakes:

• Thinking fetch will succeed without permission
• Confusing permission error with URL or reference errors
• Ignoring domain restrictions in --allow-net

5. You want to run a Deno script that fetches data from both api.example.com and data.service.org. Which command correctly grants network access to both domains using a single --allow-net flag?

hard

A. deno run --allow-net=api.example.com --allow-net=data.service.org app.ts

B. deno run --allow-net=api.example.com,data.service.org app.ts

C. deno run --allow-net app.ts api.example.com data.service.org

D. deno run --allow-net=api.example.com;data.service.org app.ts

Solution

1. Step 1: Understand multiple domain syntax for --allow-net

   Deno accepts multiple domains separated by commas in a single --allow-net flag.

2. Step 2: Evaluate each option's correctness

   deno run --allow-net=api.example.com,data.service.org app.ts uses comma-separated domains correctly. deno run --allow-net=api.example.com --allow-net=data.service.org app.ts repeats the flag (not a single flag). deno run --allow-net app.ts api.example.com data.service.org misplaces domains as arguments. deno run --allow-net=api.example.com;data.service.org app.ts uses semicolon which is incorrect.

3. Final Answer:

   deno run --allow-net=api.example.com,data.service.org app.ts -> Option B

4. Quick Check:

   Multiple domains = comma-separated in one flag [OK]

Hint: Use commas to list multiple domains in --allow-net [OK]

Common Mistakes:

• Using multiple --allow-net flags
• Separating domains with semicolons
• Placing domains after script name