HTTP Security Headers

Permissions-Policy

Decides which powerful browser features — camera, microphone, geolocation, payment — a page and its embedded iframes are even allowed to request.

What it is

Permissions-Policy (formerly Feature-Policy) lets a site declare which browser features are available to itself and to embedded content. If a feature is disabled by policy, calls to its API silently fail or return a rejected promise — even if the user would otherwise grant permission. This limits the blast radius of a compromised script or a malicious embedded iframe.

Renamed from Feature-Policy

The older Feature-Policy header used a different syntax. Permissions-Policy is the current standard; send it instead.

Syntax

Each feature is followed by an allow-list in parentheses. () means 'no origin' (fully disabled), (self) means the page's own origin, and you can list specific origins.

HTTP RESPONSE HEADER
Permissions-Policy: geolocation=(), camera=(), microphone=(), payment=(self), fullscreen=(self "https://embed.example.com")
feature=()
Feature is disabled for all origins, including your own.
feature=(self)
Allowed only for the document's own origin.
feature=(self "https://x")
Allowed for your origin plus the listed origin(s).
feature=*
Allowed for all origins, including cross-origin iframes. Use sparingly.

Why it matters

  • It prevents a compromised third-party script or embedded ad from silently accessing the camera, microphone or location.
  • It lets you explicitly disable features your site never uses, shrinking the attack surface.
  • Fine-grained per-origin allow-lists let you grant a specific trusted embed a feature without opening it to everyone.

Common mistakes

  • Leaving the header off entirely, so every embedded iframe inherits full access to powerful features by default.
  • Confusing the old Feature-Policy syntax (space-separated) with the new Permissions-Policy syntax (allow-list in parentheses).
  • Using * broadly, which re-grants features to all cross-origin frames and defeats the point.

How WebInspect checks this

  • WebInspect reports whether Permissions-Policy is present and lists the features it restricts.
  • It notes if only the deprecated Feature-Policy header is present and recommends migrating.
  • It highlights overly permissive * allow-lists on sensitive features like camera and microphone.