hardBackend

What is the Node.js permission model (--permission) and what does it protect against?

Q: What is the Node.js permission model (--permission) and what does it protect against?

**TL;DR.** The **permission model** (run with --permission ) **denies** a process access to the file system, child processes, and worker threads unless you **explicitly grant** it ( --allow-fs-read , --allow-fs-write , --allow-child-process , --allow-worker ). It shrinks the **blast radius** of a compromised dependency running arbitrary code. --permission <text class='d-sub' x='105'

57 views

Understand the problem

The experimental --permission flag restricting fs, child_process, and worker access.

nodejssecuritypermission-modelsandbox

Attempt it yourself

Sketch your approach before reading the solution — that's what interviews test.

Stuck? AI Nudge Available

Get a conceptual hint to guide your logic without spoiling the final implementation.

Study the solution

The solution is waiting

Give it an honest attempt first — then compare your thinking with the full walkthrough.

Read the code

Run with least privilege

# Deny everything, then allow only what the app needs:
node --permission \
     --allow-fs-read=/app \
     --allow-fs-write=/app/uploads \
     server.js

# Inside code you can check grants:
# process.permission.has('fs.write', '/app/uploads')  // true

Join the discussion

Discussion (0)

No responses yet. Be the first to share what you think.

How do you capture and analyze a heap snapshot to find a memory leak?