Network permissions (--allow-net) in Deno - Mini Project: Build & Apply

Using Network Permissions with Deno (--allow-net)

📖 Scenario: You are building a simple Deno script that fetches data from a public API. Deno requires explicit permission to access the network for security reasons.

🎯 Goal: Create a Deno script that fetches JSON data from a URL. You will set up the URL, configure the network permission flag, write the fetch logic, and complete the script to run with the correct permission.

📋 What You'll Learn

Create a variable with the exact API URL string

Add a variable to hold the network permission flag string

Write an async function to fetch data from the URL using fetch()

Add the command comment to run the script with the --allow-net flag

💡 Why This Matters

🌍 Real World

Many Deno scripts need to access web APIs securely. Using network permissions helps protect your system by allowing only approved network access.

💼 Career

Understanding Deno's permission model is important for developers working on secure server-side JavaScript or TypeScript applications.

1

Set up the API URL

Create a variable called apiUrl and set it to the string "https://jsonplaceholder.typicode.com/todos/1".

Deno

# Create a variable called apiUrl with the exact URL string
# Your code here

Hint

Use const apiUrl = "https://jsonplaceholder.typicode.com/todos/1" to store the URL.

2

Add network permission flag variable

Add a variable called netPermission and set it to the string "--allow-net".

Deno

const apiUrl = "https://jsonplaceholder.typicode.com/todos/1"
# Add a variable called netPermission with the string "--allow-net"
# Your code here

Hint

Use const netPermission = "--allow-net" to store the permission flag.

3

Write the fetch function

Write an async function called fetchTodo that fetches data from apiUrl using fetch(), awaits the JSON response, and returns it.

Deno

const apiUrl = "https://jsonplaceholder.typicode.com/todos/1"
const netPermission = "--allow-net"

# Write an async function fetchTodo to fetch and return JSON data from apiUrl
# Your code here

Hint

Use async function fetchTodo() with await fetch(apiUrl) and await response.json().

4

Add run command comment with permission

Add a comment at the top of the file that shows how to run this script with the --allow-net permission flag using deno run.

Deno

# Add a comment showing the deno run command with --allow-net permission
# Your code here

const apiUrl = "https://jsonplaceholder.typicode.com/todos/1"
const netPermission = "--allow-net"

async function fetchTodo() {
    const response = await fetch(apiUrl)
    const data = await response.json()
    return data
}

Hint

Add a comment like // Run this script with: deno run --allow-net script.ts at the top.

Practice

1. What does the --allow-net flag do when running a Deno program?

easy

A. It allows the program to access the network.

B. It disables all network access for the program.

C. It grants permission to read local files.

D. It enables debugging mode for the program.

Solution

1. Step 1: Understand the purpose of --allow-net

   This flag is used to grant network access to a Deno program, which is otherwise restricted for security.

2. Step 2: Compare options with the flag's function

   Only "It allows the program to access the network." correctly states that --allow-net allows network access. Other options describe unrelated permissions or features.

3. Final Answer:

   It allows the program to access the network. -> Option A

4. Quick Check:

   Network permission = Allow network access [OK]

Hint: Remember: --allow-net means allow network access [OK]

Common Mistakes:

• Confusing --allow-net with file permissions
• Thinking it disables network access
• Mixing it up with debugging flags

2. Which of the following is the correct way to allow network access only to example.com when running a Deno script named app.ts?

easy

A. deno run app.ts --allow-net=example.com

B. deno run --allow-net app.ts example.com

C. deno run --allow-net=example.com app.ts

D. deno run --allow-net example.com app.ts

Solution

1. Step 1: Identify correct flag syntax for domain restriction

   The correct syntax is --allow-net=domain placed before the script name.

2. Step 2: Check command order and placement

   deno run --allow-net=example.com app.ts correctly places --allow-net=example.com before app.ts. Other options have incorrect order or syntax.

3. Final Answer:

   deno run --allow-net=example.com app.ts -> Option C

4. Quick Check:

   Correct flag syntax = deno run --allow-net=example.com app.ts [OK]

Hint: Put --allow-net=domain before script name [OK]

Common Mistakes:

• Placing domain after script name
• Using space instead of '=' between flag and domain
• Putting script name before flags

3. Consider this Deno command and script:

deno run --allow-net=deno.land app.ts

And app.ts contains:

const response = await fetch('https://deno.land/std/http/file_server.ts');
console.log(response.status);

What will be the output?

medium

A. SyntaxError

B. PermissionDenied: network access to "deno.land" is not allowed

C. 404

D. 200

Solution

1. Step 1: Check network permission for the domain

   The command allows network access only to "deno.land", which matches the fetch URL domain.

2. Step 2: Understand fetch behavior with permission

   Since permission is granted, fetch succeeds and returns HTTP status 200 for a valid resource.

3. Final Answer:

   200 -> Option D

4. Quick Check:

   Allowed domain fetch = 200 status [OK]

Hint: Allowed domain fetch returns 200 status [OK]

Common Mistakes:

• Assuming permission error despite allowed domain
• Confusing 404 with permission issues
• Expecting syntax errors from fetch

4. You run this command:

deno run --allow-net=example.com app.ts

Inside app.ts you fetch https://google.com. What error will you get?

medium

A. PermissionDenied: network access to "google.com" is not allowed

B. No error, fetch succeeds

C. TypeError: Invalid URL

D. ReferenceError: fetch is not defined

Solution

1. Step 1: Analyze allowed domains

   The command only allows network access to "example.com" but the script tries to fetch "google.com".

2. Step 2: Understand Deno's permission enforcement

   Deno blocks network requests to domains not allowed, causing a PermissionDenied error.

3. Final Answer:

   PermissionDenied: network access to "google.com" is not allowed -> Option A

4. Quick Check:

   Disallowed domain fetch = PermissionDenied error [OK]

Hint: Fetch outside allowed domain causes PermissionDenied [OK]

Common Mistakes:

• Thinking fetch will succeed without permission
• Confusing permission error with URL or reference errors
• Ignoring domain restrictions in --allow-net

5. You want to run a Deno script that fetches data from both api.example.com and data.service.org. Which command correctly grants network access to both domains using a single --allow-net flag?

hard

A. deno run --allow-net=api.example.com --allow-net=data.service.org app.ts

B. deno run --allow-net=api.example.com,data.service.org app.ts

C. deno run --allow-net app.ts api.example.com data.service.org

D. deno run --allow-net=api.example.com;data.service.org app.ts

Solution

1. Step 1: Understand multiple domain syntax for --allow-net

   Deno accepts multiple domains separated by commas in a single --allow-net flag.

2. Step 2: Evaluate each option's correctness

   deno run --allow-net=api.example.com,data.service.org app.ts uses comma-separated domains correctly. deno run --allow-net=api.example.com --allow-net=data.service.org app.ts repeats the flag (not a single flag). deno run --allow-net app.ts api.example.com data.service.org misplaces domains as arguments. deno run --allow-net=api.example.com;data.service.org app.ts uses semicolon which is incorrect.

3. Final Answer:

   deno run --allow-net=api.example.com,data.service.org app.ts -> Option B

4. Quick Check:

   Multiple domains = comma-separated in one flag [OK]

Hint: Use commas to list multiple domains in --allow-net [OK]

Common Mistakes:

• Using multiple --allow-net flags
• Separating domains with semicolons
• Placing domains after script name