Permissions Policy Explained

Permissions Policy is an HTTP response header that allows websites to control which browser features and powerful web APIs are available to a page and its embedded content. By explicitly enabling or disabling features such as the camera, microphone, geolocation and fullscreen access, developers can reduce the attack surface of their applications and improve user privacy.

Modern browsers provide many powerful capabilities to web applications. Permissions Policy helps ensure that these features are available only where they are actually needed.

What Is Permissions Policy?

Permissions Policy is a browser security mechanism that defines which origins may use specific browser features. The policy applies to the current document and can also restrict permissions for embedded iframes and third-party content.

Why Permissions Policy Matters

Many browser APIs provide access to sensitive device capabilities or privacy-related information. Restricting unnecessary features reduces opportunities for abuse, minimizes accidental exposure and strengthens the overall security posture of a website.

• Reduce the application's attack surface.
• Limit access to sensitive browser APIs.
• Improve user privacy.
• Control embedded third-party content.
• Enforce consistent browser security policies.

How Permissions Policy Works

When a browser loads a page, it evaluates the Permissions Policy response header before allowing access to controlled browser features. If a feature is disabled by policy, JavaScript cannot use it even if the user would normally grant permission.

Browser Requests Page
↓
Server Sends Permissions-Policy Header
↓
Browser Applies Policy
↓
Allowed Features Become Available

Example Header

Permissions-Policy: geolocation=(), camera=(), microphone=()

This policy disables access to geolocation, camera and microphone for the current document and embedded content unless explicitly permitted elsewhere.

Common Browser Features

Permissions Policy vs Content Security Policy

Although both are HTTP security headers, they solve different problems. Content Security Policy controls which resources a page may load and execute, while Permissions Policy controls which browser capabilities are available to the page.

Why Restrict Unused Features?

Applications rarely require every browser capability. Disabling unnecessary APIs follows the principle of least privilege and reduces opportunities for abuse by malicious scripts or compromised third-party content.

Policy Syntax

A Permissions Policy consists of one or more directives. Each directive specifies a browser feature and the origins that are allowed to use it. Origins may include the current website, specific trusted domains or no origins at all.

Feature Control

Permissions Policy can restrict many browser capabilities that may otherwise be available to JavaScript. Exactly which features are supported depends on browser implementations and evolving web standards.

• Camera access.
• Microphone access.
• Geolocation.
• Fullscreen mode.
• Payment Request API.
• Device sensors.
• Picture-in-Picture.

Embedded Content

One of the primary benefits of Permissions Policy is controlling what embedded iframes and third-party content can access. This helps limit the capabilities of advertisements, widgets and other embedded services.

Permissions Policy and Privacy

Restricting unnecessary browser features helps reduce privacy risks by preventing pages from requesting access to sensitive device capabilities that are unrelated to their intended functionality.

Defense in Depth

Permissions Policy should be used together with other HTTP security headers rather than as a standalone security mechanism. Each header addresses a different aspect of browser security.

Testing Permissions Policy

Developers can inspect response headers using browser developer tools and verify that restricted browser APIs behave as expected. Testing is particularly important when deploying third-party integrations that rely on specific browser capabilities.

When to Use Permissions Policy

Permissions Policy is recommended for virtually every modern web application. Even if an application does not currently use sensitive browser APIs, explicitly disabling unnecessary features provides stronger default security and reduces future risks.

• Administrative dashboards.
• Online banking applications.
• Corporate portals.
• Public websites.
• Single-page applications.
• Embedded web applications.

Common Mistakes

Permissions Policy is most effective when it reflects the actual needs of an application. Overly permissive policies leave unnecessary browser features available, while overly restrictive policies may break legitimate functionality if they are deployed without testing.

• Allowing browser features that the application never uses.
• Applying wildcard permissions without a clear requirement.
• Forgetting to test embedded third-party content.
• Assuming Permissions Policy replaces browser permission prompts.
• Ignoring browser compatibility for supported directives.
• Deploying restrictive policies without verifying application functionality.

Best Practices

• Disable every browser feature that is not required.
• Grant permissions only to trusted origins.
• Review third-party integrations before enabling additional capabilities.
• Test browser functionality after every policy change.
• Combine Permissions Policy with other HTTP security headers.
• Regularly review policies as browser standards evolve.

Frequently Asked Questions

Helpful HTTP Header Tools

A Permissions Policy Generator creates correctly formatted Permissions-Policy headers, a Security Headers Generator helps configure multiple recommended HTTP security headers together, an HTTP Header Generator builds custom response headers for testing, a CSP Header Builder creates Content Security Policy directives that complement Permissions Policy, and an HTTP Header Viewer displays the headers returned by a web server to verify security configuration.

Conclusion

Permissions Policy gives developers fine-grained control over powerful browser features, helping reduce the attack surface and improve user privacy. By explicitly enabling only the capabilities an application requires and restricting access for embedded content, organizations can build safer and more predictable web applications. Combined with Content Security Policy, HSTS, Referrer Policy and other HTTP security headers, Permissions Policy forms an important part of a comprehensive browser security strategy.