Why Deno is secure by default - Quick Recap

Recall & Review

beginner

What does it mean that Deno is "secure by default"?

Deno runs code with no access to files, network, or environment unless explicitly allowed by the user. This protects your system from harmful scripts.

beginner

How does Deno control access to the file system?

Deno requires you to use flags like --allow-read or --allow-write to give permission for file system access. Without these flags, file access is blocked.

beginner

Which flag do you use to allow network access in Deno?

You use the --allow-net flag to let your Deno program access the internet or local network.

intermediate

Why is explicit permission important in Deno's security model?

Explicit permission means you control what your code can do. This stops accidental or malicious actions like reading private files or sending data without your knowledge.

intermediate

Name two types of permissions Deno restricts by default.

Deno restricts file system access and network access by default. It also restricts environment variables and running subprocesses unless allowed.

What happens if you run a Deno script without any permission flags?

A The script runs but cannot access files, network, or environment.

B The script runs with full access to files and network.

C The script will not run at all.

D The script asks for permission during execution.

Deno runs scripts with no access to files, network, or environment unless you explicitly grant permissions using flags.

Which flag allows a Deno script to read files?

A --allow-net

B --allow-run

C --allow-env

D --allow-read

The --allow-read flag grants permission to read files from the file system.

Why does Deno restrict environment variable access by default?

A To improve performance.

B To prevent leaking sensitive information.

C Because environment variables are not useful.

D To make scripts run faster.

Environment variables can contain sensitive data like passwords, so Deno restricts access to protect your system.

How do you allow a Deno script to access the network?

A Use --allow-net flag.

B Use --allow-read flag.

C Use --allow-env flag.

D No flag needed, network is allowed by default.

The --allow-net flag explicitly grants network access to the script.

What is the main benefit of Deno's secure by default approach?

A Scripts run faster.

B Scripts can access everything easily.

C It protects your computer from harmful code.

D It makes coding more complicated.

By restricting access unless allowed, Deno helps prevent harmful or accidental damage from running code.

Explain how Deno's permission flags help keep your computer safe.

Think about what happens if a script tries to read files or connect to the internet.

Describe what "secure by default" means in Deno and why it matters.

Imagine running a program that could do anything on your computer without asking.

Practice

1. Why does Deno block file and network access by default?

easy

A. To protect your computer from harmful or unknown code

B. Because it does not support file or network operations

C. To make programs run faster

D. Because it only runs in offline mode

Solution

1. Step 1: Understand Deno's security design

   Deno is designed to be secure by default to protect users from running unsafe code.

2. Step 2: Reason about default blocking

   Blocking file and network access prevents malicious code from harming your system without permission.

3. Final Answer:

   To protect your computer from harmful or unknown code -> Option A

4. Quick Check:

   Security by default = Protect computer [OK]

Hint: Deno blocks risky actions to keep your system safe [OK]

Common Mistakes:

• Thinking Deno lacks file/network features
• Assuming blocking improves speed
• Believing Deno runs only offline

2. Which command correctly runs a Deno script with permission to read files?

easy

A. deno run --allow-file script.ts

B. deno run --allow-read script.ts

C. deno run --read script.ts

D. deno run --file-access script.ts

Solution

1. Step 1: Recall Deno permission flags

   Deno uses flags like --allow-read to grant file read access explicitly.

2. Step 2: Identify correct syntax

   Only --allow-read is the valid flag to allow reading files in Deno.

3. Final Answer:

   deno run --allow-read script.ts -> Option B

4. Quick Check:

   File read permission flag = --allow-read [OK]

Hint: Use --allow-read to permit file reading in Deno [OK]

Common Mistakes:

• Using incorrect flags like --read or --allow-file
• Forgetting to add permission flags
• Confusing permission flag names

3. What will happen if you run this Deno script without any permission flags?

console.log(Deno.readTextFileSync("data.txt"));

medium

A. It prints the contents of data.txt

B. It runs without any output

C. It creates data.txt if missing

D. It throws a permission error

Solution

1. Step 1: Understand default permissions

   Deno blocks file reading unless --allow-read is given.

2. Step 2: Predict script behavior without permissions

   Trying to read a file without permission causes a runtime permission error.

3. Final Answer:

   It throws a permission error -> Option D

4. Quick Check:

   No permission = permission error [OK]

Hint: No --allow-read means file read causes error [OK]

Common Mistakes:

• Assuming file reads succeed without permission
• Thinking file is created automatically
• Expecting silent failure without error

4. You run this command but get a permission error:
deno run script.ts
How do you fix it to allow network access?

medium

A. No fix needed, network is allowed by default

B. Add --allow-network flag to the command

C. Add --allow-net flag to the command

D. Add --net-access flag to the command

Solution

1. Step 1: Identify correct network permission flag

   Deno requires --allow-net to permit network access explicitly.

2. Step 2: Correct the command

   Adding --allow-net fixes the permission error for network operations.

3. Final Answer:

   Add --allow-net flag to the command -> Option C

4. Quick Check:

   Network permission flag = --allow-net [OK]

Hint: Use --allow-net to enable network access in Deno [OK]

Common Mistakes:

• Using wrong flag like --allow-network or --net-access
• Assuming network is allowed by default
• Not adding any permission flag

5. You want to run a Deno script that reads a file and makes a network request. Which command grants the minimum permissions needed?

hard

A. deno run --allow-read --allow-net script.ts

B. deno run --allow-all script.ts

C. deno run --allow-write --allow-net script.ts

D. deno run --allow-read script.ts

Solution

1. Step 1: Identify required permissions

   Reading a file needs --allow-read; network requests need --allow-net.

2. Step 2: Choose minimal permissions

   --allow-read and --allow-net together grant only needed access, no extras.

3. Step 3: Eliminate incorrect options

   --allow-all grants too much; --allow-write is unnecessary; --allow-read alone misses network.

4. Final Answer:

   deno run --allow-read --allow-net script.ts -> Option A

5. Quick Check:

   Minimal needed permissions = --allow-read + --allow-net [OK]

Hint: Grant only needed permissions: read + net for this script [OK]

Common Mistakes:

• Using --allow-all when minimal is better
• Confusing --allow-write with --allow-read
• Forgetting network permission