How Permissions-Policy works
Each feature gets an allowlist: () disables it entirely, self allows only your origin, and origins in quotes allow specific embedded sites. It replaced the older Feature-Policy header, which used a different syntax. Iframes also need the allow attribute for features they use.
Directives
| Value | Meaning |
|---|---|
camera=()
|
No one on the page may use the camera. |
geolocation=(self)
|
Only your own origin may ask for location. |
microphone=(self "https://meet.example.com")
|
Your origin and one embedded site. |
fullscreen=*
|
Any origin may request fullscreen. |
Examples
Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()Check it
curl -sI https://example.com | grep -i '^permissions-policy:'Paste a full set of response headers into the HTTP header checker to get every header explained and common mistakes flagged.
Related headers
- Content-Security-Policy: restricts where a page may load scripts, styles, images and other resources from, to contain XSS.
- Referrer-Policy: controls how much of the current URL is sent in the Referer header when users follow links or load resources.
- Cross-Origin-Embedder-Policy: requires every cross-origin resource a page loads to opt in to being embedded (COEP).
More security headers
Strict-Transport-Security , X-Content-Type-Options , X-Frame-Options , Cross-Origin-Opener-Policy , Cross-Origin-Resource-Policy .
Sources
Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.
Frequently asked questions
What does the Permissions-Policy header do?
The Permissions-Policy response header turns browser features such as camera, microphone, geolocation and payment on or off for a page and its iframes. Each feature gets an allowlist: () disables it entirely, self allows only your origin, and origins in quotes allow specific embedded sites. It replaced the older Feature-Policy header, which used a different syntax. Iframes also need the allow attribute for features they use.
How do I see the Permissions-Policy header?
Run "curl -sI https://example.com" to print a response’s headers, or open the Network tab in your browser’s dev tools and select the request. Paste the headers into the HTTP header checker on this site to get each one explained.