Intermediate LevelWeb Security & Cyber Defense
What is the Permissions-Policy (formerly Feature-Policy) HTTP header?
❓ Interview Prompt: Explain `Permissions-Policy` HTTP response header, restricting browser APIs (camera, microphone, geolocation, payment), and iframe inheritance.
The 'Permissions-Policy' (formerly Feature-Policy) HTTP header allows web applications to explicitly restrict which browser hardware APIs and features can be used by the page or embedded '<iframe>' elements:
Header Example:
'Permissions-Policy: camera=(), microphone=(), geolocation=(self "https://maps.example.com"), payment=()'
•
Disables camera, microphone, and payment request access completely, protecting users if an XSS script executes!
Code Implementation Example
http
HTTP/1.1 200 OK
Permissions-Policy: camera=(), microphone=(), geolocation=(), display-capture=()💡Permissions-Policy header disabling camera and microphone hardware APIs.
🎯 Interview Key Takeaway
Configure Permissions-Policy headers to disable unused browser hardware APIs and protect user privacy.
#Permissions-Policy#Headers#Browser Security#Intermediate
Back to all Web Security & Cyber Defense Questions→