Using Deno's --allow-read Flag to Safely Read Local Files

Quick answer: grant --allow-read to read files

By default Deno executes scripts in a secure sandbox that blocks file system, network, and environment access. To read a local file you must explicitly allow read permission, either for the whole filesystem or a specific directory.

Worked example

1. Create a file named hello.txt in your current directory with any content, for example:

echo 'Hello from Deno' > hello.txt

1. Create a TypeScript script read.ts that attempts to read the file:

// read.ts
try {
  const text = await Deno.readTextFile('hello.txt');
  console.log(text);
} catch (err) {
  if (err instanceof Deno.errors.PermissionDenied) {
    console.error('Permission denied: cannot read hello.txt');
  } else {
    throw err;
  }
}

Run the script without any permission flags:

deno run read.ts

Expected behavior: the script prints a permission‑denied message and exits with a non‑zero status code.

Now grant read access for the current directory and run again:

deno run --allow-read=. read.ts

If hello.txt resides in the current directory, the script outputs its contents and exits with code 0.

Scoped permissions

Instead of allowing the whole current directory you can limit access to a subtree. For example, to allow reading only files under /tmp:

deno run --allow-read=/tmp read.ts

Attempts to read a file outside /tmp will throw a PermissionDenied error, even if the script tries to use a relative path that resolves outside that tree.

Limits and common mistakes

• Overly broad flags: Using --allow-read without a path grants access to the entire filesystem. In shared or multi‑user environments this can expose unintended files.
• Missing flag: Forgetting to add the required flag results in a PermissionDenied error that may be mistaken for a bug in the script. Always inspect the error type or the process exit code to confirm a permission issue.
• Relative paths and working directory: The path supplied to --allow-read is resolved against the process’s current working directory. Running the script from a different folder may require adjusting the flag (e.g., --allow-read=../project).
• Runtime validation: Permissions are checked when the file operation is performed, not when the script starts. Code that conditionally reads a file will only fail when that branch executes.
• Windows path separators: On Windows, use backslashes or forward slashes consistently; the flag accepts either, but the working directory rules still apply.

Verifying the result

After a successful run, check the exit code:

# Unix/Linux/macOS
echo $?
# Windows PowerShell
$LASTEXITCODE

A successful read returns 0; a permission‑denied attempt returns a non‑zero value.

You can also verify that the script caught the error by observing the console output: a permission failure prints the message from the catch block, while a success prints the file contents.