Header Prism

HTTP header & security policy tools

05Permissions-Policy · Feature-PolicyGenerator & converter

Permissions-Policy generator

Decide, feature by feature, who may use the camera, location, payments or USB on your pages and in the frames they embed. Paste an old Feature-Policy to convert it.

A

Features

–
  • cameraCamera (getUserMedia video) · default self
  • microphoneMicrophone (getUserMedia audio) · default self
  • geolocationGeolocation API · default self
  • display-captureScreen capture (getDisplayMedia) · default self
  • fullscreenElement.requestFullscreen() · default self
  • autoplayAutoplay of media with sound · default self
  • picture-in-picturePicture-in-picture video · default every origin
  • paymentPayment Request API · default self
  • publickey-credentials-getWebAuthn sign-in (passkeys) · default self
  • publickey-credentials-createWebAuthn registration · default self
  • identity-credentials-getFedCM federated sign-in · default self
  • otp-credentialsWebOTP (SMS one-time codes) · default self
  • clipboard-readAsync clipboard read · default self
  • clipboard-writeAsync clipboard write · default self
  • web-sharenavigator.share() · default self
  • encrypted-mediaEncrypted Media Extensions (DRM) · default self
  • screen-wake-lockScreen Wake Lock · default self
  • storage-accessStorage Access API · default every origin
  • usbWebUSB · default self
  • serialWeb Serial · default self
  • hidWebHID · default self
  • bluetoothWeb Bluetooth · default self
  • midiWeb MIDI · default self
  • gamepadGamepad API · default self
  • xr-spatial-trackingWebXR (VR/AR) · default self
  • accelerometerAccelerometer sensor · default self
  • gyroscopeGyroscope sensor · default self
  • magnetometerMagnetometer sensor · default self
  • ambient-light-sensorAmbient light sensor · default self
  • idle-detectionIdle Detection API · default self
  • local-fontsLocal Font Access · default self
  • window-managementMulti-screen window placement · default self
  • compute-pressureCompute Pressure API · default self
  • browsing-topicsTopics API (interest-based ads) · default every origin
  • attribution-reportingAttribution Reporting (ad conversions) · default every origin
  • sync-xhrSynchronous XMLHttpRequest · default every origin
  • cross-origin-isolatedCross-origin isolation for frames · default self
B

Convert or load

Feature-Policy → Permissions-Policy
    C

    Output

    –
    
						
    
						
    
					
    
				
    
			
    
		
    
	
    

	
    
		
    
			
    Reading and writing Permissions-Policy
    
			
    Each feature takes an allowlist in parentheses. The header uses Structured Fields syntax, which is stricter than the old Feature-Policy:
    
			
      
				
    • camera=() disables the camera for the page and every frame it embeds.
      • 
				
    • geolocation=(self) allows your own origin only; embedded frames from other sites are refused.
      • 
				
    • geolocation=(self "https://maps.example.com") also delegates it to that origin. Origins must be in double quotes.
      • 
				
    • fullscreen=* allows every origin, as long as the iframe also allows it.
      • 
			
    
			
    Members are separated by commas, not semicolons, and a feature you leave out keeps the browser's default (usually your own origin). An embedded frame needs both your header and its own allow attribute: copy the iframe tab for that.
    
			
    Unknown feature names are ignored rather than rejected, so check the spelling of anything the converter flags. Then add the header with the rest of your configuration in the security headers generator.
    
		
    
	
    

	
    
		
    FAQ
    Permissions-Policy questions
    
		
    
			
    
				Should I disable features my site never uses?
				
    Yes. Disabling them costs nothing and stops injected scripts or embedded third-party frames from asking visitors for camera, microphone or location access in your site's name.
    
			
    
			
    
				Is Feature-Policy still needed?
				
    No. Current browsers read Permissions-Policy, and Chromium ignores Feature-Policy when both are sent. Convert the old header and remove it.
    
			
    
			
    
				What about interest-cohort=()?
				
    It opted out of FLoC, which Chrome abandoned. It does nothing now; browsing-topics=() opts out of its successor, the Topics API.