Glossary / Permissions-Policy

Permissions-Policy

Permissions-Policy is an HTTP header that enables or disables a page's and its embedded frames' access to browser features: camera, microphone, geolocation, sensors and so on. It used to be called Feature-Policy. It limits what your site, and third-party code on it, is allowed to do.

A policy is a list of features and the origins allowed to use them. For example, camera=() blocks the camera entirely, geolocation=(self) allows geolocation only for your domain, and microphone=(self "https://example.com") also allows one external origin.

The main benefit is reining in third-party code. If the page carries ad or analytics scripts in frames, the policy stops them from quietly asking for the user's camera or location. Even if your own code is compromised, features you disabled stay unavailable.

The header does not replace the browser's permission prompt - the browser still asks. It sets an upper bound: if a feature is disabled by policy, the prompt never even appears. Features you do not mention fall back to the browser default, so it is worth explicitly disabling whatever the site clearly does not need.

Example

Permissions-Policy: geolocation=(self), camera=(), microphone=()

Common mistakes

• Still using the old Feature-Policy header with its old syntax. Permissions-Policy replaced it with a different value format.
• Getting the syntax wrong: writing geolocation 'self' as in CSP, when here you need geolocation=(self) with parentheses.
• Assuming the header asks the user for permission itself. It only allows or forbids a feature; the browser makes the actual prompt.
• Not explicitly disabling unneeded features, so third-party frames keep whatever the browser default allows.

Related terms

• HSTS (Strict-Transport-Security) HSTS (Strict-Transport-Security)
• Content-Security-Policy (CSP) Content-Security-Policy (CSP)
• X-Frame-Options X-Frame-Options
• X-Content-Type-Options X-Content-Type-Options
• Referrer-Policy Referrer-Policy