Network permissions (--allow-net) in Deno - Cheat Sheet & Quick Revision

Recall & Review

beginner

What does the --allow-net flag do in Deno?

It grants the Deno program permission to access the network, allowing it to make HTTP requests or open sockets.

intermediate

How can you restrict network access to only specific domains using --allow-net?

You can specify domains or IPs after --allow-net, like --allow-net=example.com,api.example.com, to allow network access only to those addresses.

beginner

What happens if you run a Deno script that tries to access the network without --allow-net?

Deno will block the network request and throw a permission error, preventing the script from accessing the network.

beginner

Why does Deno require explicit network permissions like --allow-net?

To protect users by default, Deno restricts network access so scripts can't connect to the internet or local network without permission, improving security.

intermediate

Can you combine --allow-net with other permission flags in Deno? Give an example.

Yes, for example: deno run --allow-net --allow-read script.ts allows network access and file reading in the same run.

What is the default network access behavior in Deno without --allow-net?

A Network access is allowed

B Network access is blocked

C Only localhost access is allowed

D Network access is logged but allowed

Deno blocks network access by default unless --allow-net is specified.

How do you allow network access only to example.com in Deno?

A <code>--allow-net=example.com</code>

B <code>--allow-net</code> alone

C <code>--allow-net=*</code>

D <code>--allow-net=localhost</code>

Specifying the domain after --allow-net restricts access to that domain only.

Which command runs a script with network and file read permissions?

A deno run script.ts

B deno run --allow-net script.ts

C deno run --allow-read script.ts

D deno run --allow-net --allow-read script.ts

You can combine multiple permission flags to grant several permissions at once.

If a script tries to fetch data from the internet without --allow-net, what happens?

A The fetch fails with a permission error

B The fetch succeeds silently

C The script crashes without error

D The fetch is delayed until permission is granted

Deno enforces permissions strictly and throws an error if network access is denied.

Why is explicit network permission important in Deno?

A It allows automatic retries on failure

B It speeds up network requests

C It improves security by preventing unauthorized network access

D It enables logging of network traffic

Explicit permissions help protect users from malicious or unintended network activity.

Explain how the --allow-net flag controls network access in Deno and why it is important.

Think about what happens if you don't use the flag and why Deno needs it.

Describe how you would run a Deno script that needs to fetch data from a specific website and read local files.

Consider combining permissions in one command line.

Practice

1. What does the --allow-net flag do when running a Deno program?

easy

A. It allows the program to access the network.

B. It disables all network access for the program.

C. It grants permission to read local files.

D. It enables debugging mode for the program.

Solution

1. Step 1: Understand the purpose of --allow-net

   This flag is used to grant network access to a Deno program, which is otherwise restricted for security.

2. Step 2: Compare options with the flag's function

   Only "It allows the program to access the network." correctly states that --allow-net allows network access. Other options describe unrelated permissions or features.

3. Final Answer:

   It allows the program to access the network. -> Option A

4. Quick Check:

   Network permission = Allow network access [OK]

Hint: Remember: --allow-net means allow network access [OK]

Common Mistakes:

• Confusing --allow-net with file permissions
• Thinking it disables network access
• Mixing it up with debugging flags

2. Which of the following is the correct way to allow network access only to example.com when running a Deno script named app.ts?

easy

A. deno run app.ts --allow-net=example.com

B. deno run --allow-net app.ts example.com

C. deno run --allow-net=example.com app.ts

D. deno run --allow-net example.com app.ts

Solution

1. Step 1: Identify correct flag syntax for domain restriction

   The correct syntax is --allow-net=domain placed before the script name.

2. Step 2: Check command order and placement

   deno run --allow-net=example.com app.ts correctly places --allow-net=example.com before app.ts. Other options have incorrect order or syntax.

3. Final Answer:

   deno run --allow-net=example.com app.ts -> Option C

4. Quick Check:

   Correct flag syntax = deno run --allow-net=example.com app.ts [OK]

Hint: Put --allow-net=domain before script name [OK]

Common Mistakes:

• Placing domain after script name
• Using space instead of '=' between flag and domain
• Putting script name before flags

3. Consider this Deno command and script:

deno run --allow-net=deno.land app.ts

And app.ts contains:

const response = await fetch('https://deno.land/std/http/file_server.ts');
console.log(response.status);

What will be the output?

medium

A. SyntaxError

B. PermissionDenied: network access to "deno.land" is not allowed

C. 404

D. 200

Solution

1. Step 1: Check network permission for the domain

   The command allows network access only to "deno.land", which matches the fetch URL domain.

2. Step 2: Understand fetch behavior with permission

   Since permission is granted, fetch succeeds and returns HTTP status 200 for a valid resource.

3. Final Answer:

   200 -> Option D

4. Quick Check:

   Allowed domain fetch = 200 status [OK]

Hint: Allowed domain fetch returns 200 status [OK]

Common Mistakes:

• Assuming permission error despite allowed domain
• Confusing 404 with permission issues
• Expecting syntax errors from fetch

4. You run this command:

deno run --allow-net=example.com app.ts

Inside app.ts you fetch https://google.com. What error will you get?

medium

A. PermissionDenied: network access to "google.com" is not allowed

B. No error, fetch succeeds

C. TypeError: Invalid URL

D. ReferenceError: fetch is not defined

Solution

1. Step 1: Analyze allowed domains

   The command only allows network access to "example.com" but the script tries to fetch "google.com".

2. Step 2: Understand Deno's permission enforcement

   Deno blocks network requests to domains not allowed, causing a PermissionDenied error.

3. Final Answer:

   PermissionDenied: network access to "google.com" is not allowed -> Option A

4. Quick Check:

   Disallowed domain fetch = PermissionDenied error [OK]

Hint: Fetch outside allowed domain causes PermissionDenied [OK]

Common Mistakes:

• Thinking fetch will succeed without permission
• Confusing permission error with URL or reference errors
• Ignoring domain restrictions in --allow-net

5. You want to run a Deno script that fetches data from both api.example.com and data.service.org. Which command correctly grants network access to both domains using a single --allow-net flag?

hard

A. deno run --allow-net=api.example.com --allow-net=data.service.org app.ts

B. deno run --allow-net=api.example.com,data.service.org app.ts

C. deno run --allow-net app.ts api.example.com data.service.org

D. deno run --allow-net=api.example.com;data.service.org app.ts

Solution

1. Step 1: Understand multiple domain syntax for --allow-net

   Deno accepts multiple domains separated by commas in a single --allow-net flag.

2. Step 2: Evaluate each option's correctness

   deno run --allow-net=api.example.com,data.service.org app.ts uses comma-separated domains correctly. deno run --allow-net=api.example.com --allow-net=data.service.org app.ts repeats the flag (not a single flag). deno run --allow-net app.ts api.example.com data.service.org misplaces domains as arguments. deno run --allow-net=api.example.com;data.service.org app.ts uses semicolon which is incorrect.

3. Final Answer:

   deno run --allow-net=api.example.com,data.service.org app.ts -> Option B

4. Quick Check:

   Multiple domains = comma-separated in one flag [OK]

Hint: Use commas to list multiple domains in --allow-net [OK]

Common Mistakes:

• Using multiple --allow-net flags
• Separating domains with semicolons
• Placing domains after script name