Network permissions (--allow-net) in Deno - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when a Deno script tries to fetch without --allow-net?

Consider this Deno script that tries to fetch data from a website:

const response = await fetch('https://example.com');
const text = await response.text();
console.log(text);

What will happen if you run this script without the --allow-net flag?

Deno

const response = await fetch('https://example.com');
const text = await response.text();
console.log(text);

A The script will run and print the website content to the console.

B The script will throw a permission error and stop running.

C The script will run but print an empty string.

D The script will run but print 'undefined'.

💡 Hint

Think about what Deno does when a script tries to access the network without permission.

Deno requires explicit permission to access the network. Without --allow-net, any network request will cause a permission error and stop the script.

📝 Syntax

intermediate

Which command correctly runs a Deno script with network access only to example.com?

You want to run a Deno script that fetches data only from example.com. Which command correctly grants network permission only to that domain?

A deno run --allow-net=example.com script.ts

B deno run --allow-net=https://example.com script.ts

C deno run --allow-net=example.com:443 script.ts

D deno run --allow-net=https://example.com:443 script.ts

💡 Hint

Check the correct syntax for specifying hostnames in --allow-net.

The --allow-net flag accepts hostnames (optionally with port) without protocol. So example.com is correct. Including protocol causes errors.

🔧 Debug

advanced

Why does this Deno script fail despite using --allow-net?

Look at this command and script:

deno run --allow-net=example.com script.ts

const response = await fetch('https://httpbin.org/data');
const data = await response.json();
console.log(data);

Why does the script fail with a permission error?

Deno

const response = await fetch('https://httpbin.org/data');
const data = await response.json();
console.log(data);

A Because the allowed domain is example.com but the script accesses httpbin.org, which is different.

B Because the script needs --allow-read permission to fetch data.

C Because the script must use --unstable flag to allow network access.

D Because the URL uses HTTPS and --allow-net only allows HTTP by default.

💡 Hint

Check if the allowed domain matches the domain in the fetch URL exactly.

The --allow-net=example.com flag only allows network access to example.com exactly. Domains like httpbin.org are not included unless explicitly allowed.

❓ state_output

advanced

What is the output of this Deno script with --allow-net?

Given this script and running it with deno run --allow-net:

try {
  const response = await fetch('https://httpbin.org/status/404');
  console.log(response.status);
} catch (error) {
  console.log('Error:', error.message);
}

What will be printed?

Deno

try {
  const response = await fetch('https://httpbin.org/status/404');
  console.log(response.status);
} catch (error) {
  console.log('Error:', error.message);
}

A Error: PermissionDenied: network access to "https://httpbin.org/status/404" is not allowed

B Error: Network request failed

C 404

D undefined

💡 Hint

Think about what happens when a fetch gets a 404 status but network permission is granted.

The fetch succeeds in making the request because network permission is granted. The server responds with status 404, which is printed. No error is thrown for HTTP errors.

🧠 Conceptual

expert

How does Deno's --allow-net flag improve security compared to Node.js?

Which statement best explains how Deno's --allow-net flag enhances security compared to Node.js default behavior?

A Deno requires a special API to make network requests, while Node.js uses standard APIs.

B Deno encrypts all network traffic automatically, while Node.js does not.

C Deno runs network requests in a sandboxed environment, while Node.js runs them in the main thread.

D Deno blocks all network access by default and requires explicit permission, while Node.js allows network access by default.

💡 Hint

Think about default network access permissions in both runtimes.

Deno improves security by denying network access unless the user explicitly grants it with --allow-net. Node.js allows network access by default, which can be risky.

Practice

1. What does the --allow-net flag do when running a Deno program?

easy

A. It allows the program to access the network.

B. It disables all network access for the program.

C. It grants permission to read local files.

D. It enables debugging mode for the program.

Solution

1. Step 1: Understand the purpose of --allow-net

   This flag is used to grant network access to a Deno program, which is otherwise restricted for security.

2. Step 2: Compare options with the flag's function

   Only "It allows the program to access the network." correctly states that --allow-net allows network access. Other options describe unrelated permissions or features.

3. Final Answer:

   It allows the program to access the network. -> Option A

4. Quick Check:

   Network permission = Allow network access [OK]

Hint: Remember: --allow-net means allow network access [OK]

Common Mistakes:

• Confusing --allow-net with file permissions
• Thinking it disables network access
• Mixing it up with debugging flags

2. Which of the following is the correct way to allow network access only to example.com when running a Deno script named app.ts?

easy

A. deno run app.ts --allow-net=example.com

B. deno run --allow-net app.ts example.com

C. deno run --allow-net=example.com app.ts

D. deno run --allow-net example.com app.ts

Solution

1. Step 1: Identify correct flag syntax for domain restriction

   The correct syntax is --allow-net=domain placed before the script name.

2. Step 2: Check command order and placement

   deno run --allow-net=example.com app.ts correctly places --allow-net=example.com before app.ts. Other options have incorrect order or syntax.

3. Final Answer:

   deno run --allow-net=example.com app.ts -> Option C

4. Quick Check:

   Correct flag syntax = deno run --allow-net=example.com app.ts [OK]

Hint: Put --allow-net=domain before script name [OK]

Common Mistakes:

• Placing domain after script name
• Using space instead of '=' between flag and domain
• Putting script name before flags

3. Consider this Deno command and script:

deno run --allow-net=deno.land app.ts

And app.ts contains:

const response = await fetch('https://deno.land/std/http/file_server.ts');
console.log(response.status);

What will be the output?

medium

A. SyntaxError

B. PermissionDenied: network access to "deno.land" is not allowed

C. 404

D. 200

Solution

1. Step 1: Check network permission for the domain

   The command allows network access only to "deno.land", which matches the fetch URL domain.

2. Step 2: Understand fetch behavior with permission

   Since permission is granted, fetch succeeds and returns HTTP status 200 for a valid resource.

3. Final Answer:

   200 -> Option D

4. Quick Check:

   Allowed domain fetch = 200 status [OK]

Hint: Allowed domain fetch returns 200 status [OK]

Common Mistakes:

• Assuming permission error despite allowed domain
• Confusing 404 with permission issues
• Expecting syntax errors from fetch

4. You run this command:

deno run --allow-net=example.com app.ts

Inside app.ts you fetch https://google.com. What error will you get?

medium

A. PermissionDenied: network access to "google.com" is not allowed

B. No error, fetch succeeds

C. TypeError: Invalid URL

D. ReferenceError: fetch is not defined

Solution

1. Step 1: Analyze allowed domains

   The command only allows network access to "example.com" but the script tries to fetch "google.com".

2. Step 2: Understand Deno's permission enforcement

   Deno blocks network requests to domains not allowed, causing a PermissionDenied error.

3. Final Answer:

   PermissionDenied: network access to "google.com" is not allowed -> Option A

4. Quick Check:

   Disallowed domain fetch = PermissionDenied error [OK]

Hint: Fetch outside allowed domain causes PermissionDenied [OK]

Common Mistakes:

• Thinking fetch will succeed without permission
• Confusing permission error with URL or reference errors
• Ignoring domain restrictions in --allow-net

5. You want to run a Deno script that fetches data from both api.example.com and data.service.org. Which command correctly grants network access to both domains using a single --allow-net flag?

hard

A. deno run --allow-net=api.example.com --allow-net=data.service.org app.ts

B. deno run --allow-net=api.example.com,data.service.org app.ts

C. deno run --allow-net app.ts api.example.com data.service.org

D. deno run --allow-net=api.example.com;data.service.org app.ts

Solution

1. Step 1: Understand multiple domain syntax for --allow-net

   Deno accepts multiple domains separated by commas in a single --allow-net flag.

2. Step 2: Evaluate each option's correctness

   deno run --allow-net=api.example.com,data.service.org app.ts uses comma-separated domains correctly. deno run --allow-net=api.example.com --allow-net=data.service.org app.ts repeats the flag (not a single flag). deno run --allow-net app.ts api.example.com data.service.org misplaces domains as arguments. deno run --allow-net=api.example.com;data.service.org app.ts uses semicolon which is incorrect.

3. Final Answer:

   deno run --allow-net=api.example.com,data.service.org app.ts -> Option B

4. Quick Check:

   Multiple domains = comma-separated in one flag [OK]

Hint: Use commas to list multiple domains in --allow-net [OK]

Common Mistakes:

• Using multiple --allow-net flags
• Separating domains with semicolons
• Placing domains after script name