Permissions-Policy

A list of feature names, each with an allow-list: `Permissions-Policy: geolocation=(), camera=(), microphone=(self)`.

An empty list `()` disables the feature entirely, including for the page itself.

`(self)` permits the page's own origin. A quoted origin permits that origin specifically, and `*` permits any.

It replaced the earlier `Feature-Policy` header, which used a different syntax. Both may be present during a transition, and the newer one takes precedence.

Device access: camera, microphone, geolocation, accelerometer, gyroscope, magnetometer, USB, serial, Bluetooth.

Capabilities: payment request, fullscreen, picture-in-picture, screen wake lock, clipboard access, autoplay.

Identity-adjacent features: the federated credential management interface, and any others browsers add.

The set differs between browsers and grows over time, so an unrecognised feature name is ignored rather than causing an error.

An `allow` attribute on an individual iframe grants a subset of the document's own permissions to that frame, which is how an embed that genuinely needs the camera is given it without opening the whole page.

A page that does not use the camera has nothing to lose by disabling it, and a compromised third-party script on that page then cannot ask for it.

Embedded frames inherit the restrictions, which is the main point: an advertisement or a widget cannot request geolocation on a page that has disabled it.

It documents intent. A policy listing what a page uses is a statement future changes have to justify departing from.

It is not a substitute for consent or for a Content Security Policy. Those address different things, and all three are commonly set together.

`curl -I https://example.com | grep -i permissions-policy` shows the current policy.

Start from what the site actually uses. Disabling a feature the site needs breaks it silently, since the request simply fails rather than prompting.

The browser console reports when a feature is blocked by policy, naming the feature, which makes a mistake quick to find.

Check pages with embedded third-party content specifically, since those are the ones where the containment matters.

Review it whenever a feature is added. A policy written once and never revisited is the reason a new payment or clipboard feature fails in production and works locally.

Keep the list explicit rather than relying on defaults: browsers differ on what is permitted absent a policy, and writing the intended set down removes that variance.