Why Deno is secure by default - See It in Action

Why Deno is secure by default

📖 Scenario: You are building a simple Deno script that reads a file and prints its content. However, Deno is secure by default and restricts access to the file system unless permissions are explicitly granted.

🎯 Goal: Learn how to handle Deno's security model by setting up a script that tries to read a file and understand how to configure permissions to allow this safely.

📋 What You'll Learn

Create a variable called fileName with the exact value "hello.txt"

Create a variable called decoder that is a new TextDecoder instance

Write an async function called readFileContent that reads the file content using Deno.readFile and decodes it

Call the readFileContent function and assign its result to a variable called content

Add a comment explaining that Deno requires explicit permission to read files

💡 Why This Matters

🌍 Real World

Deno is used to build secure server-side applications where controlling access to system resources is important.

💼 Career

Understanding Deno's security model is essential for developers working with modern JavaScript runtimes focused on safety and simplicity.

1

DATA SETUP: Create file name and decoder

Create a variable called fileName and set it to the string "hello.txt". Then create a variable called decoder and set it to a new instance of TextDecoder.

Deno

// Create a variable called fileName with value "hello.txt"
// Create a variable called decoder as a new TextDecoder instance
// Your code here

Hint

Use const fileName = "hello.txt"; and const decoder = new TextDecoder();

2

CONFIGURATION: Add a comment about Deno permissions

Add a comment above your code that says // Deno requires explicit permission to read files.

Deno

// Add a comment about Deno file read permissions
// Your code here

Hint

Write the comment exactly as // Deno requires explicit permission to read files

3

CORE LOGIC: Create async function to read and decode file content

Write an async function called readFileContent that uses Deno.readFile(fileName) to read the file, then returns the decoded string using decoder.decode().

Deno

// Deno requires explicit permission to read files
const fileName = "hello.txt";
const decoder = new TextDecoder();

// Write async function readFileContent
// Your code here

Hint

Use async function readFileContent() and inside use await Deno.readFile(fileName) then decode the data.

4

COMPLETION: Call the function and store the result

Call the readFileContent function and assign its awaited result to a variable called content.

Deno

// Deno requires explicit permission to read files
const fileName = "hello.txt";
const decoder = new TextDecoder();

async function readFileContent() {
    const data = await Deno.readFile(fileName);
    return decoder.decode(data);
}

// Call readFileContent and assign to content
// Your code here

Hint

Use const content = await readFileContent(); to get the file content.

Practice

1. Why does Deno block file and network access by default?

easy

A. To protect your computer from harmful or unknown code

B. Because it does not support file or network operations

C. To make programs run faster

D. Because it only runs in offline mode

Solution

1. Step 1: Understand Deno's security design

   Deno is designed to be secure by default to protect users from running unsafe code.

2. Step 2: Reason about default blocking

   Blocking file and network access prevents malicious code from harming your system without permission.

3. Final Answer:

   To protect your computer from harmful or unknown code -> Option A

4. Quick Check:

   Security by default = Protect computer [OK]

Hint: Deno blocks risky actions to keep your system safe [OK]

Common Mistakes:

• Thinking Deno lacks file/network features
• Assuming blocking improves speed
• Believing Deno runs only offline

2. Which command correctly runs a Deno script with permission to read files?

easy

A. deno run --allow-file script.ts

B. deno run --allow-read script.ts

C. deno run --read script.ts

D. deno run --file-access script.ts

Solution

1. Step 1: Recall Deno permission flags

   Deno uses flags like --allow-read to grant file read access explicitly.

2. Step 2: Identify correct syntax

   Only --allow-read is the valid flag to allow reading files in Deno.

3. Final Answer:

   deno run --allow-read script.ts -> Option B

4. Quick Check:

   File read permission flag = --allow-read [OK]

Hint: Use --allow-read to permit file reading in Deno [OK]

Common Mistakes:

• Using incorrect flags like --read or --allow-file
• Forgetting to add permission flags
• Confusing permission flag names

3. What will happen if you run this Deno script without any permission flags?

console.log(Deno.readTextFileSync("data.txt"));

medium

A. It prints the contents of data.txt

B. It runs without any output

C. It creates data.txt if missing

D. It throws a permission error

Solution

1. Step 1: Understand default permissions

   Deno blocks file reading unless --allow-read is given.

2. Step 2: Predict script behavior without permissions

   Trying to read a file without permission causes a runtime permission error.

3. Final Answer:

   It throws a permission error -> Option D

4. Quick Check:

   No permission = permission error [OK]

Hint: No --allow-read means file read causes error [OK]

Common Mistakes:

• Assuming file reads succeed without permission
• Thinking file is created automatically
• Expecting silent failure without error

4. You run this command but get a permission error:
deno run script.ts
How do you fix it to allow network access?

medium

A. No fix needed, network is allowed by default

B. Add --allow-network flag to the command

C. Add --allow-net flag to the command

D. Add --net-access flag to the command

Solution

1. Step 1: Identify correct network permission flag

   Deno requires --allow-net to permit network access explicitly.

2. Step 2: Correct the command

   Adding --allow-net fixes the permission error for network operations.

3. Final Answer:

   Add --allow-net flag to the command -> Option C

4. Quick Check:

   Network permission flag = --allow-net [OK]

Hint: Use --allow-net to enable network access in Deno [OK]

Common Mistakes:

• Using wrong flag like --allow-network or --net-access
• Assuming network is allowed by default
• Not adding any permission flag

5. You want to run a Deno script that reads a file and makes a network request. Which command grants the minimum permissions needed?

hard

A. deno run --allow-read --allow-net script.ts

B. deno run --allow-all script.ts

C. deno run --allow-write --allow-net script.ts

D. deno run --allow-read script.ts

Solution

1. Step 1: Identify required permissions

   Reading a file needs --allow-read; network requests need --allow-net.

2. Step 2: Choose minimal permissions

   --allow-read and --allow-net together grant only needed access, no extras.

3. Step 3: Eliminate incorrect options

   --allow-all grants too much; --allow-write is unnecessary; --allow-read alone misses network.

4. Final Answer:

   deno run --allow-read --allow-net script.ts -> Option A

5. Quick Check:

   Minimal needed permissions = --allow-read + --allow-net [OK]

Hint: Grant only needed permissions: read + net for this script [OK]

Common Mistakes:

• Using --allow-all when minimal is better
• Confusing --allow-write with --allow-read
• Forgetting network permission