topic
Verified 2026-09-18Permissions Policy
Permissions Policy controls which origins may use selected browser capabilities in a document or iframe.
Declare only the capabilities the application needs, understand inherited iframe policy, and test browser behavior. Permissions Policy is a browser control, not a server authorization boundary.
httpbrowsersecurityprivacyheader
Reference (http)
Permissions-Policy: camera=(), microphone=(), geolocation=(self)
Declare only the capabilities the application needs, understand inherited iframe policy, and test browser behavior. Permissions Policy is a browser control, not a server authorization boundary.
Common mistakes
- Assuming a disabled browser capability protects a backend endpoint or copying a policy without checking iframe inheritance.