Feature-Policy: encrypted-media

This is an experimental technology
Check the Browser compatibility table carefully before using this in production.

The HTTP Feature-Policy header encrypted-media directive controls whether the current document is allowed to use the Encrypted Media Extensions API (EME). When this policy is enabled, the Promise returned by Navigator.requestMediaKeySystemAccess() will reject with a DOMException.

Syntax

Feature-Policy: encrypted-media <allowlist>;
<allowlist>

An allowlist is a list of origins that takes one or more of the following values, separated by spaces:

  • *: The feature will be allowed in this document, and all nested browsing contexts (iframes) regardless of their origin.
  • 'self': The feature will be allowed in this document, and in all nested browsing contexts (iframes) in the same origin.
  • 'src': (In an iframe allow attribute only) The feature will be allowed in this iframe, as long as the document loaded into it comes from the same origin as the URL in the iframe's src attribute.
  • 'none': The feature is disabled in top-level and nested browsing contexts.
  • <origin(s)>: The feature is allowed for specific origins (for example, https://example.com). Origins should be separated by a space.

The values * (enable for all origins) or 'none' (disable for all origins) may only be used alone, while 'self' and 'src' may be used with one or more origins.

Features are each defined to have a default allowlist, which is one of:

  • *: The feature is allowed by default in top-level browsing contexts and all nested browsing contexts (iframes).
  • 'self': The feature is allowed by default in top-level browsing contexts and in nested browsing contexts (iframes) in the same origin. The feature is not allowed in cross-origin documents in nested browsing contexts.
  • 'none': The feature is disabled in top-level and nested browsing contexts.
The default value is 'self'.

Specifications

Specification Status Comment
Feature Policy Editor's Draft Initial definition.

Browser compatibility

Update compatibility data on GitHub
DesktopMobile
ChromeEdgeFirefoxInternet ExplorerOperaSafariAndroid webviewChrome for AndroidFirefox for AndroidOpera for AndroidSafari on iOSSamsung Internet
encrypted-media
Experimental
Chrome Full support 60Edge No support NoFirefox Full support 65
Disabled
Full support 65
Disabled
Disabled From version 65: this feature is behind the dom.security.featurePolicy.header.enabled preference (needs to be set to true). To change preferences in Firefox, visit about:config.
IE No support NoOpera Full support 48Safari No support NoWebView Android Full support 60Chrome Android Full support 60Firefox Android Full support 65
Disabled
Full support 65
Disabled
Disabled From version 65: this feature is behind the dom.security.featurePolicy.header.enabled preference (needs to be set to true). To change preferences in Firefox, visit about:config.
Opera Android Full support 45Safari iOS No support NoSamsung Internet Android No support No

Legend

Full support  
Full support
No support  
No support
Experimental. Expect behavior to change in the future.
Experimental. Expect behavior to change in the future.
User must explicitly enable this feature.
User must explicitly enable this feature.

See also

Related Topics
  1. HTTP
  2. Guides:
  3. Resources and URIs
    1. Identifying resources on the Web
    2. Data URIs
    3. Introduction to MIME Types
    4. Complete list of MIME Types
    5. Choosing between www and non-www URLs
  4. HTTP guide
    1. Basics of HTTP
    2. Overview of HTTP
    3. Evolution of HTTP
    4. HTTP Messages
    5. A typical HTTP session
    6. Connection management in HTTP/1.x
    7. Protocol upgrade mechanism
  5. HTTP security
    1. Content Security Policy (CSP)
    2. HTTP Public Key Pinning (HPKP)
    3. HTTP Strict Transport Security (HSTS)
    4. Cookie security
    5. X-Content-Type-Options
    6. X-Frame-Options
    7. X-XSS-Protection
    8. Mozilla web security guidelines
    9. Mozilla Observatory
  6. HTTP access control (CORS)
  7. HTTP authentication
  8. HTTP caching
  9. HTTP compression
  10. HTTP conditional requests
  11. HTTP content negotiation
  12. HTTP cookies
  13. HTTP range requests
  14. HTTP redirects
  15. HTTP specifications
  16. Feature policy
  17. References:
  18. HTTP headers
    1. Accept
    2. Accept-Charset
    3. Accept-Encoding
    4. Accept-Language
    5. Accept-Patch
    6. Accept-Ranges
    7. Access-Control-Allow-Credentials
    8. Access-Control-Allow-Headers
    9. Access-Control-Allow-Methods
    10. Access-Control-Allow-Origin
    11. Access-Control-Expose-Headers
    12. Access-Control-Max-Age
    13. Access-Control-Request-Headers
    14. Access-Control-Request-Method
    15. Age
    16. Allow
    17. Alt-Svc
    18. Authorization
    19. Cache-Control
    20. Clear-Site-Data
    21. Connection
    22. Content-Disposition
    23. Content-Encoding
    24. Content-Language
    25. Content-Length
    26. Content-Location
    27. Content-Range
    28. Content-Security-Policy
    29. Content-Security-Policy-Report-Only
    30. Content-Type
    31. Cookie
    32. Cookie2
    33. Cross-Origin-Resource-Policy
    34. DNT
    35. Date
    36. Digest
    37. ETag
    38. Early-Data
    39. Expect
    40. Expect-CT
    41. Expires
    42. Feature-Policy
    43. Forwarded
    44. From
    45. Host
    46. If-Match
    47. If-Modified-Since
    48. If-None-Match
    49. If-Range
    50. If-Unmodified-Since
    51. Index
    52. Keep-Alive
    53. Large-Allocation
    54. Last-Modified
    55. Link
    56. Location
    57. Origin
    58. Pragma
    59. Proxy-Authenticate
    60. Proxy-Authorization
    61. Public-Key-Pins
    62. Public-Key-Pins-Report-Only
    63. Range
    64. Referer
    65. Referrer-Policy
    66. Retry-After
    67. Save-Data
    68. Sec-WebSocket-Accept
    69. Server
    70. Server-Timing
    71. Set-Cookie
    72. Set-Cookie2
    73. SourceMap
    74. Strict-Transport-Security
    75. TE
    76. Timing-Allow-Origin
    77. Tk
    78. Trailer
    79. Transfer-Encoding
    80. Upgrade-Insecure-Requests
    81. User-Agent
    82. Vary
    83. Via
    84. WWW-Authenticate
    85. Want-Digest
    86. Warning
    87. X-Content-Type-Options
    88. X-DNS-Prefetch-Control
    89. X-Forwarded-For
    90. X-Forwarded-Host
    91. X-Forwarded-Proto
    92. X-Frame-Options
    93. X-XSS-Protection
  19. HTTP request methods
    1. CONNECT
    2. DELETE
    3. GET
    4. HEAD
    5. OPTIONS
    6. PATCH
    7. POST
    8. PUT
    9. TRACE
  20. HTTP response status codes
    1. 100 Continue
    2. 101 Switching Protocols
    3. 103 Early Hints
    4. 200 OK
    5. 201 Created
    6. 202 Accepted
    7. 203 Non-Authoritative Information
    8. 204 No Content
    9. 205 Reset Content
    10. 206 Partial Content
    11. 300 Multiple Choices
    12. 301 Moved Permanently
    13. 302 Found
    14. 303 See Other
    15. 304 Not Modified
    16. 307 Temporary Redirect
    17. 308 Permanent Redirect
    18. 400 Bad Request
    19. 401 Unauthorized
    20. 402 Payment Required
    21. 403 Forbidden
    22. 404 Not Found
    23. 405 Method Not Allowed
    24. 406 Not Acceptable
    25. 407 Proxy Authentication Required
    26. 408 Request Timeout
    27. 409 Conflict
    28. 410 Gone
    29. 411 Length Required
    30. 412 Precondition Failed
    31. 413 Payload Too Large
    32. 414 URI Too Long
    33. 415 Unsupported Media Type
    34. 416 Range Not Satisfiable
    35. 417 Expectation Failed
    36. 418 I'm a teapot
    37. 422 Unprocessable Entity
    38. 425 Too Early
    39. 426 Upgrade Required
    40. 428 Precondition Required
    41. 429 Too Many Requests
    42. 431 Request Header Fields Too Large
    43. 451 Unavailable For Legal Reasons
    44. 500 Internal Server Error
    45. 501 Not Implemented
    46. 502 Bad Gateway
    47. 503 Service Unavailable
    48. 504 Gateway Timeout
    49. 505 HTTP Version Not Supported
    50. 511 Network Authentication Required
  21. CSP directives
    1. CSP: base-uri
    2. CSP: block-all-mixed-content
    3. CSP: child-src
    4. CSP: connect-src
    5. CSP: default-src
    6. CSP: font-src
    7. CSP: form-action
    8. CSP: frame-ancestors
    9. CSP: frame-src
    10. CSP: img-src
    11. CSP: manifest-src
    12. CSP: media-src
    13. CSP: navigate-to
    14. CSP: object-src
    15. CSP: plugin-types
    16. CSP: prefetch-src
    17. CSP: referrer
    18. CSP: report-to
    19. CSP: report-uri
    20. CSP: require-sri-for
    21. CSP: sandbox
    22. CSP: script-src
    23. CSP: script-src-attr
    24. CSP: script-src-elem
    25. CSP: style-src
    26. CSP: style-src-attr
    27. CSP: style-src-elem
    28. CSP: trusted-types
    29. CSP: upgrade-insecure-requests
    30. CSP: worker-src
  22. CORS errors
    1. Reason: CORS disabled
    2. Reason: CORS header 'Access-Control-Allow-Origin' does not match 'xyz'
    3. Reason: CORS header 'Access-Control-Allow-Origin' missing
    4. Reason: CORS header ‘Origin’ cannot be added
    5. Reason: CORS preflight channel did not succeed
    6. Reason: CORS request did not succeed
    7. Reason: CORS request external redirect not allowed
    8. Reason: CORS request not HTTP
    9. Reason: Credential is not supported if the CORS header ‘Access-Control-Allow-Origin’ is ‘*’
    10. Reason: Did not find method in CORS header ‘Access-Control-Allow-Methods’
    11. Reason: Multiple CORS header 'Access-Control-Allow-Origin' not allowed
    12. Reason: expected ‘true’ in CORS header ‘Access-Control-Allow-Credentials’
    13. Reason: invalid token ‘xyz’ in CORS header ‘Access-Control-Allow-Headers’
    14. Reason: invalid token ‘xyz’ in CORS header ‘Access-Control-Allow-Methods’
    15. Reason: missing token ‘xyz’ in CORS header ‘Access-Control-Allow-Headers’ from CORS preflight channel
  23. Feature-Policy directives
    1. Feature-Policy: accelerometer
    2. Feature-Policy: ambient-light-sensor
    3. Feature-Policy: autoplay
    4. Feature-Policy: camera
    5. Feature-Policy: display-capture
    6. Feature-Policy: document-domain
    7. Feature-Policy: encrypted-media
    8. Feature-Policy: fullscreen
    9. Feature-Policy: geolocation
    10. Feature-Policy: gyroscope
    11. Feature-Policy: layout-animations
    12. Feature-Policy: legacy-image-formats
    13. Feature-Policy: magnetometer
    14. Feature-Policy: microphone
    15. Feature-Policy: midi
    16. Feature-Policy: oversized-images
    17. Feature-Policy: payment
    18. Feature-Policy: picture-in-picture
    19. Feature-Policy: speaker
    20. Feature-Policy: sync-xhr
    21. Feature-Policy: unoptimized-images
    22. Feature-Policy: unsized-media
    23. Feature-Policy: usb
    24. Feature-Policy: vibrate
    25. Feature-Policy: vr
    26. Feature-Policy: wake-lock
    27. Feature-Policy: webauthn
    28. Feature-Policy: xr