Permissions-Policy
ResponseActivePermissions-Policy (formerly Feature-Policy) controls which browser features and APIs a page and its iframes can use – camera, microphone, geolocation, payment, autoplay, fullscreen, and more. It restricts powerful capabilities to only the contexts that need them, reducing attack surface if a page is compromised.
Permissions-Policy: <feature>=(<allowlist>)[, <feature>=(<allowlist>)]*
Description
Permissions-Policy replaces the deprecated Feature-Policy header (which used a different syntax). It uses a structured syntax with allowlists per feature. 'self' allows the feature only for the current origin. A list of origins allows specific third-party origins. An empty list '()' blocks the feature entirely. The policy applies to the page and can be delegated to iframes via the allow attribute.
Directives
| Directive | Description |
|---|---|
| camera=() | Block camera access for this page and all iframes. |
| geolocation=(self) | Allow geolocation only for same-origin. |
| payment=(self "https://pay.example.com") | Allow payment for self and specific origin. |
| autoplay=() | Block autoplay media entirely. |
Examples
Restrictive policy
http
Permissions-Policy: camera=(), microphone=(), geolocation=(self), payment=()Allow specific
http
Permissions-Policy: fullscreen=(self), autoplay=(self "https://cdn.example.com")