What is Permissions Policy?

Permissions Policy (formerly Feature Policy) is an HTTP header that allows web developers to control which browser features and APIs (e.g., camera, geolocation, fullscreen) are available to a document and its embedded iframes, enhancing security and privacy.

How do I implement Permissions Policy?

You implement Permissions Policy by sending a `Permissions-Policy` HTTP response header from your web server. This header specifies a list of features and their allowed origins.

What is the difference between `Permissions-Policy` and `Content-Security-Policy`?

`Permissions-Policy` controls access to browser features and APIs (e.g., camera, geolocation). `Content-Security-Policy` controls which resources (scripts, styles, images) a browser is allowed to load, primarily to prevent XSS and injection attacks.

What does `geolocation=(self)` mean in a Permissions Policy?

`geolocation=(self)` means that the `geolocation` API is only allowed to be used by the current origin (the domain serving the document). It blocks all other origins, including embedded iframes from different domains, from accessing geolocation.

Can I use Permissions Policy to block specific iframes from using a feature?

Yes, by default, a Permissions Policy applies to all nested iframes. You can further restrict or grant permissions to specific iframes using the `allow` attribute on the ` ` tag, which can override or extend the parent document's policy.

Does Permissions Policy protect against all privacy concerns?

Permissions Policy significantly enhances privacy by restricting access to sensitive browser features. However, it is one layer of defense. Comprehensive privacy requires secure server-side practices, data handling policies, and user consent mechanisms.

Permissions Policy Generator

Permissions Policy Generator Overview

Generate Feature-Policy/Permissions-Policy headers.

A Permissions Policy Generator is an online utility that helps construct `Permissions-Policy` HTTP headers, formerly known as `Feature-Policy`. This security mechanism allows web developers to selectively enable or disable various browser features and APIs for a given document and any embedded iframes. By controlling access to sensitive functionalities like the camera, microphone, geolocation, or full-screen mode, a Permissions Policy enhances user privacy and security, preventing malicious or unnecessary use of these features. This generator operates by providing an interface to select specific features (e.g., `geolocation`, `camera`, `microphone`, `fullscreen`) and define their allowed origins. For each feature, users can specify `self` (same origin), `*` (any origin), `none` (block all), or a list of trusted origins. The tool then compiles these selections into a correctly formatted `Permissions-Policy` HTTP header string, adhering to the W3C Permissions Policy specification. It ensures proper syntax, including semicolons between policies and spaces between origins, simplifying the creation of complex policies. Web developers and security architects use Permissions Policy generators to enforce granular control over browser capabilities within their applications. It is particularly useful for protecting user data by restricting access to sensitive hardware or APIs. Site administrators deploy these policies to mitigate risks associated with third-party content, ensuring that embedded scripts or iframes cannot exploit browser features without explicit permission, thereby improving the overall security and privacy posture of their web properties.

How to Use Permissions Policy Generator

Select the browser features you want to control (e.g., `geolocation`, `camera`, `microphone`).
For each selected feature, choose the desired allowlist: `self`, `*`, `none`, or specific origins.
If specifying origins, enter the full URLs (e.g., `https://trusted.example.com`).
Review the generated `Permissions-Policy` header string in the output area.
Copy the header and implement it in your web server configuration.

Frequently Asked Questions

What is Permissions Policy?: Permissions Policy (formerly Feature Policy) is an HTTP header that allows web developers to control which browser features and APIs (e.g., camera, geolocation, fullscreen) are available to a document and its embedded iframes, enhancing security and privacy.
How do I implement Permissions Policy?: You implement Permissions Policy by sending a `Permissions-Policy` HTTP response header from your web server. This header specifies a list of features and their allowed origins.
What is the difference between `Permissions-Policy` and `Content-Security-Policy`?: `Permissions-Policy` controls access to browser features and APIs (e.g., camera, geolocation). `Content-Security-Policy` controls which resources (scripts, styles, images) a browser is allowed to load, primarily to prevent XSS and injection attacks.
What does `geolocation=(self)` mean in a Permissions Policy?: `geolocation=(self)` means that the `geolocation` API is only allowed to be used by the current origin (the domain serving the document). It blocks all other origins, including embedded iframes from different domains, from accessing geolocation.
Can I use Permissions Policy to block specific iframes from using a feature?: Yes, by default, a Permissions Policy applies to all nested iframes. You can further restrict or grant permissions to specific iframes using the `allow` attribute on the `` tag, which can override or extend the parent document's policy.</dd> <dt>Does Permissions Policy protect against all privacy concerns?</dt> <dd>Permissions Policy significantly enhances privacy by restricting access to sensitive browser features. However, it is one layer of defense. Comprehensive privacy requires secure server-side practices, data handling policies, and user consent mechanisms.</dd> </dl> <h2>Related Dev Tools</h2> <ul> <li><a href="/tools/ip-geolocation-lookup">IP Geolocation</a> - Find location data for any IP address</li><li><a href="/tools/domain-availability-checker">Domain Availability</a> - Check if a domain name is available for registration</li><li><a href="/tools/react-component-generator">React Component Gen</a> - Generate boilerplate for React components</li><li><a href="/tools/htaccess-file-generator">.htaccess File Generator</a> - Create Apache redirects and security rules</li><li><a href="/tools/robots-txt-tester">robots.txt Tester</a> - Test if a specific URL is allowed by robots.txt</li><li><a href="/tools/json-to-toon-converter">JSON to TOON Converter</a> - Optimize JSON for LLMs (30-60% Token Reduction)</li><li><a href="/tools/regex-tester-debugger">Regex Tester</a> - Test and debug regular expressions</li><li><a href="/tools/uuid-v4-generator">UUID Generator</a> - Generate unique identifiers (UUIDs/GUIDs) instantly</li> </ul> </div>  <noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-P6G5CCR7" height="0" width="0" style="display:none;visibility:hidden">