Permissions-Policy Builder

A third party iframe on your page can ask for camera, microphone or location, and the browser prompts the visitor as if the request came from you. Permissions-Policy, the successor to Feature-Policy, shuts that down at the source. What stops most people is the syntax, since feature=() with empty parentheses looks like a typo when it actually means an empty allowlist.

This page deserves an honest warning. The label asks for one feature per line, but the field is a single line input where you cannot type a line break at all. The code splits on newlines and joins with commas, so in practice it just prefixes Permissions-Policy: onto whatever you typed. Worse, the prefilled example contains literal \n sequences instead of real newlines, and those come straight through into the output. Clear the field and type a comma separated list.

The shape is feature=(allowlist). Empty parentheses deny it to everyone, (self) allows only your own origin, and (self "https://partner.com") allows yours plus one third party, double quotes included. A realistic line looks like geolocation=(), camera=(), microphone=(), fullscreen=(self), with no trailing comma. After you ship it, read the response headers in DevTools and exercise your iframes, since the policy is inherited by them. The string is built in your browser and nothing is uploaded.