Permissions-Policy

Permissions-Policy is an HTTP header that lets a site declare which powerful browser features, such as camera, microphone, geolocation or payment, may be used by its own pages and by third-party content embedded in them. It replaced the older Feature-Policy header.

Why it matters

Pages often include third-party iframes or scripts. Without a policy, a compromised or careless embed might request sensitive capabilities in your site's context. Turning off features you never use limits that exposure and also reduces accidental use. It is a defence-in-depth measure, not a replacement for user permission prompts.

Example

Permissions-Policy: camera=(), microphone=(), geolocation=(self)

Here camera=() and microphone=() disable those features for everyone. geolocation=(self) allows only the site's own origin. A frame can be given access through the allow attribute, as in <iframe allow="geolocation">, if the policy permits it.

Common mistakes

• Using the old Feature-Policy syntax in the new header.
• Blocking a feature the site needs, such as microphone on a video call page.
• Assuming support is identical in all browsers; check current compatibility.
• Forgetting that embedded content needs an explicit grant.

Related

• Security headers
• Referrer-Policy
• iframe
• Content Security Policy
• टूल: Security headers checker

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.