🔒 Disable Camera, Microphone, Geolocation by Default
Third-party scripts accessing sensitive APIs? Permissions Policy controls which features are allowed. Defense in depth.
📝 HTTP Header
# Disable everything Permissions-Policy: geolocation=(), camera=(), microphone=(), payment=() # Allow only same origin Permissions-Policy: geolocation=(self), camera=(self) # Allow specific domains Permissions-Policy: geolocation=(self "https://trusted.com") # Allow all (default) Permissions-Policy: geolocation=*
🎯 Permissions Policy Features
- accelerometer - ambient-light-sensor - autoplay - camera - display-capture - encrypted-media - fullscreen - geolocation - gyroscope - magnetometer - microphone - midi - payment - picture-in-picture - usb - wake-lock - web-share Example: Permissions-Policy: camera=(self "https://video-call.com"), microphone=(self "https://video-call.com"), geolocation=()
💡 Use Cases
- Ad iframes: disable geolocation, camera, microphone
- Blog comments: disable everything except autoplay
- Banking site: allow only payment, disable everything else
- Video call: allow camera, microphone only on video-call subdomain
“Malicious ad iframe tried to access geolocation. Permissions Policy blocked it. Users never saw permission prompt. Security without user friction.”