Build permissions policy

Build a Permissions-Policy header for camera, microphone, geolocation, and other features.

freeworks offlinenothing uploaded
ToolPermissions Policy Builder
Input
Output
—
Put this on your own site

The frame below runs the same code as this page, in the reader's own browser. Nothing is sent to us, and nothing is sent to you.

Pick a dark background and the text and panels follow it, so the frame stays readable on a dark page.

Preview

How it works

Feature names and origin allowlists become a Permissions-Policy header; iframe allow attributes can further delegate a feature. Browsers enforce the policy for powerful APIs.

  • Self or none reduce ambient access.
  • Cross-origin delegation remains opt-in.

Worked example

Restrictive policy disabling sensitive browser APIs
Build a Permissions-Policy that disables camera, microphone, and geolocation while allowing fullscreen and autoplay for self
Input
											Camera: none
Microphone: none
Geolocation: none
Fullscreen: self
Payment: none
Accelerometer: none
Gyroscope: none
Magnetometer: none
Usb: none
Autoplay: self
Picture in picture: self
Display capture: none
Output
												# Permissions-Policy Header

Permissions-Policy: camera=(), microphone=(), geolocation=(), fullscreen=self, payment=(), accelerometer=(), gyroscope=(), magnetometer=(), usb=(), autoplay=self, picture-in-picture=self, display-capture=()

# Apache (.htaccess)
Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), fullscreen=self, payment=(), accelerometer=(), gyroscope=(), magnetometer=(), usb=(), autoplay=self, picture-in-picture=self, display-capture=()"

# Nginx
add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), fullscreen=self, payment=(), accelerometer=(), gyroscope=(), magnetometer=(), usb=(), autoplay=self, picture-in-picture=self, display-…

When to use this

Sites, embedded payment frames, and security reviews build feature policy.

Edge cases

  • A wildcard grants access broadly.
  • An iframe allow cannot override a denied response policy.
  • Unknown features are ignored.

References