Network permissions (--allow-net) in Deno - Step-by-Step Execution

Concept Flow - Network permissions (--allow-net)

Start Deno Script

↓

Check --allow-net flag

Yes↓

Allow network access

↓

Script makes network request

↓

Request succeeds

↓

End Script

↓

If no --allow-net

↓

Block network request

↓

Throw permission error

↓

End Script

Deno checks if the --allow-net flag is given before allowing network requests. Without it, network calls are blocked with an error.

Execution Sample

Deno

const response = await fetch('https://example.com');
const text = await response.text();
console.log(text);

This code tries to fetch data from example.com and print it. It needs --allow-net to work.

Execution Table

Step	Action	Permission Check	Result	Output
1	Start script	N/A	Script starts
2	Attempt fetch('https://example.com')	--allow-net present?	Yes	Request sent
3	Wait for response	N/A	Response received
4	Read response text	N/A	Text read
5	console.log(text)	N/A	Text printed	HTML content of example.com
6	End script	N/A	Script ends

💡 Script ends after successful network request because --allow-net flag was provided.

Variable Tracker

Variable	Start	After Step 2	After Step 3	After Step 4	Final
response	undefined	Promise pending	Response object	Response object	Response object
text	undefined	undefined	undefined	Response text string	Response text string

Key Moments - 2 Insights

Why does the script fail if we don't use --allow-net?

Without --allow-net, the permission check at Step 2 blocks the fetch request, causing a permission error and stopping the script.

Does --allow-net allow all network requests or only specific ones?

By default, --allow-net allows all network requests. You can restrict it by specifying domains, but if just --allow-net is used, all requests are allowed.

Visual Quiz - 3 Questions

Look at the execution table, what happens at Step 2 if --allow-net is NOT provided?

A The fetch request succeeds normally

B The fetch request is blocked and a permission error is thrown

C The script ignores the fetch and continues

D The script crashes without any error

💡 Hint

Check the 'Permission Check' and 'Result' columns at Step 2 in the execution table

According to the variable tracker, what is the value of 'text' after Step 4?

A Response text string

B undefined

C Promise pending

D Response object

💡 Hint

Look at the 'text' row under 'After Step 4' in the variable tracker

If you want to allow network requests only to example.com, how would the --allow-net flag change?

A --allow-net=https://example.com

B --allow-net

C --allow-net=example.com

D --allow-net=all

💡 Hint

Deno allows restricting network permissions by specifying domains after --allow-net

Concept Snapshot

Deno blocks network requests by default.
Use --allow-net flag to permit network access.
Without it, fetch calls cause permission errors.
You can restrict allowed domains by specifying them after --allow-net.
Always grant minimal permissions for security.

Full Transcript

This visual execution shows how Deno handles network permissions with the --allow-net flag. When the script starts, Deno checks if --allow-net is given. If yes, network requests like fetch('https://example.com') are allowed and succeed. The response is read and printed. If --allow-net is missing, the fetch is blocked at the permission check step, causing an error. Variables like response and text change as the fetch progresses. Beginners often wonder why fetch fails without --allow-net or how to restrict network access. The quiz questions reinforce understanding by referencing the execution steps and variable states.

Practice

1. What does the --allow-net flag do when running a Deno program?

easy

A. It allows the program to access the network.

B. It disables all network access for the program.

C. It grants permission to read local files.

D. It enables debugging mode for the program.

Solution

1. Step 1: Understand the purpose of --allow-net

   This flag is used to grant network access to a Deno program, which is otherwise restricted for security.

2. Step 2: Compare options with the flag's function

   Only "It allows the program to access the network." correctly states that --allow-net allows network access. Other options describe unrelated permissions or features.

3. Final Answer:

   It allows the program to access the network. -> Option A

4. Quick Check:

   Network permission = Allow network access [OK]

Hint: Remember: --allow-net means allow network access [OK]

Common Mistakes:

• Confusing --allow-net with file permissions
• Thinking it disables network access
• Mixing it up with debugging flags

2. Which of the following is the correct way to allow network access only to example.com when running a Deno script named app.ts?

easy

A. deno run app.ts --allow-net=example.com

B. deno run --allow-net app.ts example.com

C. deno run --allow-net=example.com app.ts

D. deno run --allow-net example.com app.ts

Solution

1. Step 1: Identify correct flag syntax for domain restriction

   The correct syntax is --allow-net=domain placed before the script name.

2. Step 2: Check command order and placement

   deno run --allow-net=example.com app.ts correctly places --allow-net=example.com before app.ts. Other options have incorrect order or syntax.

3. Final Answer:

   deno run --allow-net=example.com app.ts -> Option C

4. Quick Check:

   Correct flag syntax = deno run --allow-net=example.com app.ts [OK]

Hint: Put --allow-net=domain before script name [OK]

Common Mistakes:

• Placing domain after script name
• Using space instead of '=' between flag and domain
• Putting script name before flags

3. Consider this Deno command and script:

deno run --allow-net=deno.land app.ts

And app.ts contains:

const response = await fetch('https://deno.land/std/http/file_server.ts');
console.log(response.status);

What will be the output?

medium

A. SyntaxError

B. PermissionDenied: network access to "deno.land" is not allowed

C. 404

D. 200

Solution

1. Step 1: Check network permission for the domain

   The command allows network access only to "deno.land", which matches the fetch URL domain.

2. Step 2: Understand fetch behavior with permission

   Since permission is granted, fetch succeeds and returns HTTP status 200 for a valid resource.

3. Final Answer:

   200 -> Option D

4. Quick Check:

   Allowed domain fetch = 200 status [OK]

Hint: Allowed domain fetch returns 200 status [OK]

Common Mistakes:

• Assuming permission error despite allowed domain
• Confusing 404 with permission issues
• Expecting syntax errors from fetch

4. You run this command:

deno run --allow-net=example.com app.ts

Inside app.ts you fetch https://google.com. What error will you get?

medium

A. PermissionDenied: network access to "google.com" is not allowed

B. No error, fetch succeeds

C. TypeError: Invalid URL

D. ReferenceError: fetch is not defined

Solution

1. Step 1: Analyze allowed domains

   The command only allows network access to "example.com" but the script tries to fetch "google.com".

2. Step 2: Understand Deno's permission enforcement

   Deno blocks network requests to domains not allowed, causing a PermissionDenied error.

3. Final Answer:

   PermissionDenied: network access to "google.com" is not allowed -> Option A

4. Quick Check:

   Disallowed domain fetch = PermissionDenied error [OK]

Hint: Fetch outside allowed domain causes PermissionDenied [OK]

Common Mistakes:

• Thinking fetch will succeed without permission
• Confusing permission error with URL or reference errors
• Ignoring domain restrictions in --allow-net

5. You want to run a Deno script that fetches data from both api.example.com and data.service.org. Which command correctly grants network access to both domains using a single --allow-net flag?

hard

A. deno run --allow-net=api.example.com --allow-net=data.service.org app.ts

B. deno run --allow-net=api.example.com,data.service.org app.ts

C. deno run --allow-net app.ts api.example.com data.service.org

D. deno run --allow-net=api.example.com;data.service.org app.ts

Solution

1. Step 1: Understand multiple domain syntax for --allow-net

   Deno accepts multiple domains separated by commas in a single --allow-net flag.

2. Step 2: Evaluate each option's correctness

   deno run --allow-net=api.example.com,data.service.org app.ts uses comma-separated domains correctly. deno run --allow-net=api.example.com --allow-net=data.service.org app.ts repeats the flag (not a single flag). deno run --allow-net app.ts api.example.com data.service.org misplaces domains as arguments. deno run --allow-net=api.example.com;data.service.org app.ts uses semicolon which is incorrect.

3. Final Answer:

   deno run --allow-net=api.example.com,data.service.org app.ts -> Option B

4. Quick Check:

   Multiple domains = comma-separated in one flag [OK]

Hint: Use commas to list multiple domains in --allow-net [OK]

Common Mistakes:

• Using multiple --allow-net flags
• Separating domains with semicolons
• Placing domains after script name