How to Grant Specific Permissions in Deno: Simple Guide

In Deno, you grant specific permissions by using command-line flags like --allow-read, --allow-net, and others when running your script. Each flag controls access to a particular resource, letting you limit what your code can do for better security.

Syntax

Use permission flags with the deno run command to grant access. Common flags include:

• --allow-read: Allows reading files.
• --allow-write: Allows writing files.
• --allow-net: Allows network access.
• --allow-env: Allows access to environment variables.
• --allow-run: Allows running subprocesses.

You can specify specific files, URLs, or hosts by adding them after the flag, e.g., --allow-read=/path/to/file.

bash

deno run --allow-read=./data.txt --allow-net=example.com script.ts

Example

This example shows how to grant read permission for a specific file and network access to a specific host. The script reads a file and fetches data from a URL.

typescript

import { readTextFile } from "https://deno.land/std/fs/mod.ts";

async function main() {
  const data = await Deno.readTextFile("./data.txt");
  console.log("File content:", data);

  const response = await fetch("https://example.com");
  const text = await response.text();
  console.log("Fetched data length:", text.length);
}

main();

Output

File content: Hello Deno!
Fetched data length: 1256

Common Pitfalls

Common mistakes include:

• Not granting any permissions, causing runtime errors.
• Using --allow-all which grants all permissions and reduces security.
• Forgetting to specify exact files or hosts when needed, leading to broader access than intended.
• Confusing permission flags or misspelling them.

Always grant the minimum permissions your script needs.

bash

/* Wrong: No permissions granted, script will fail */
deno run script.ts

/* Right: Grant only read permission for a file */
deno run --allow-read=./data.txt script.ts

Quick Reference

Permission Flag	Description	Example Usage
--allow-read	Allow reading files or directories	--allow-read=./config.json
--allow-write	Allow writing files or directories	--allow-write=./logs
--allow-net	Allow network access	--allow-net=example.com
--allow-env	Allow access to environment variables	--allow-env
--allow-run	Allow running subprocesses	--allow-run
--allow-all	Allow all permissions (not recommended)	--allow-all

Key Takeaways

Grant permissions in Deno using command-line flags like --allow-read and --allow-net.

Specify exact files or hosts to limit access and improve security.

Avoid using --allow-all to keep your code safe.

If permissions are missing, Deno will throw runtime errors.

Always grant the minimum permissions your script needs.