Experimental: This is an experimental technology
Check the Browser compatibility table carefully before using this in production.
The HTTP Permissions-Policy response header provides a mechanism to allow and deny the use of browser features in a document or within any
To apply a policy to the current origin and others, you'd do this:
This is important: By default, if an
It is worth giving the src value a special mention. We mentioned above that using this allowlist value will mean that the associated feature will be allowed in this
SecureCorp Inc. wants to disable Microphone (for example MediaDevices.getUserMedia()) and Geolocation APIs in its application. It can do so using the following response header:
Permissions-Policy: microphone=(), geolocation=()
By specifying () for the origin list, the specified features will be disabled for all browsing contexts (this includes all
If a different origin ended up getting loaded into
| Specification |
|---|
| Permissions Policy # permissions-policy-http-header-field |