Vous lisez la version anglaise de ce contenu car il n’existe pas encore de traduction dans cette langue. Aidez-nous à traduire cet article !
La politique de fonctionnalités permet aux développeurs Web d'activer, de désactiver et de modifier de manière sélective le comportement de certaines fonctionnalités et de certaines API du navigateur. C'est similaire à Content Security Policy mais contrôle les fonctionnalités au lieu du comportement de sécurité.
En un mot
La politique de fonctionnalité fournit un mécanisme permettant de déclarer explicitement quelle fonctionnalité est utilisée (ou non utilisée) sur l'ensemble de votre site Web. Cela vous permet d'intégrer les meilleures pratiques, même si la base de code évolue au fil du temps, ainsi que de composer du contenu tiers en toute sécurité, en limitant le nombre de fonctionnalités disponibles.
With Feature Policy, you opt-in to a set of "policies" for the browser to enforce on specific features used throughout a website. These policies restrict what APIs the site can access or modify the browser's default behavior for certain features.
Examples of what you can do with Feature Policy:
- Change the default behavior of autoplay on mobile and third party videos.
- Restrict a site from using sensitive APIs like camera or microphone.
- Allow iframes to use the fullscreen API.
- Block the use of outdated APIs like synchronous XHR and
document.write()
. - Ensure images are sized properly and are not too big for the viewport.
Concepts and usage
Feature Policy allows you to control which origins can use which features, both in the top-level page and in embedded frames. Essentially, you write a policy, which is an allowed list of origins for each feature. For every feature controlled by Feature Policy, the feature is only enabled in the current document or frame if its origin matches the allowed list of origins.
For each policy-controlled feature, the browser maintains a list of origins for which the feature is enabled, known as an allowlist. If you do not specify a policy for a feature, then a default allowlist will be used. The default allowlist is specific to each feature.
Writing a policy
A policy is described using a set of individual policy directives. A policy directive is a combination of a defined feature name, and an allowlist of origins that can use the feature.
Specifying your policy
Feature Policy provides two ways to specify policies to control features:
- The
Feature-Policy
HTTP header. - The
allow
attribute on iframes.
The primary difference between the HTTP header and the allow
attribute is that the allow attribute only controls features within an iframe. The header controls features in the response and any embedded content within the page.
For more details see Using Feature Policy.
Inferring the policy
Scripts can programatically query information about the feature policy via the FeaturePolicy
object located at either Document.featurePolicy
or HTMLIFrameElement.featurePolicy
.
Types of policy-controlled features
Though Feature Policy provides control of multiple features using a consistent syntax, the behavior of policy controlled features varies and depends on several factors.
The general principle is that there should be an intuitive or non-breaking way for web developers to detect or handle the case when the feature is disabled. Newly introduced features may have an explicit API to signal the state. Existing features that later integrate with Feature Policy will typically use existing mechanisms. Some approaches include:
- Return "permission denied" for JavaScript APIs that require user permission grants.
- Return
false
or error from an existing JavaScript API that provides access to feature. - Change the default values or options that control the feature behavior.
The current set of policy-controlled features fall into two broad categories:
- Enforcing best practices for good user experiences.
- Providing granular control over sensitive or powerful features.
Best practices for good user experiences
There are several policy-controlled features to help enforce best practices for providing good performance and user experiences.
In most cases, the policy-controlled features represent functionality that when used will negatively impact the user experience. To avoid breaking existing web content, the default for such policy-controlled features is to allow the functionality to be used by all origins. Best practices are then enforced by using policies that disable the policy-controlled features. For more details see "Enforcing best practices for good user experiences".
The features include:
- Layout-inducing animations
- Legacy image formats
- Oversized images
- Synchronous scripts
- Synchronous XMLHTTPRequest
- Unoptimized images
- Unsized media
Granular control over certain features
The web provides functionality and APIs that may have privacy or security risks if abused. In some cases, you may wish to strictly limit how such functionality is used on a website. There are policy-controlled features to allow functionality to be enabled/disabled for specific origins or frames within a website. Where available, the feature integrates with the Permissions API, or feature-specific mechanisms to check if the feature is available.
The features include (see Features list):
- Accelerometer
- Ambient light sensor
- Autoplay
- Camera
- Encrypted media
- Fullscreen
- Geolocation
- Gyroscope
- Magnetometer
- Microphone
- Midi
- PaymentRequest
- Picture-in-picture
- Speaker
- USB
- VR / XR
Examples
- Using Feature Policy
- See Feature Policy Demos for example usage of many policies.
Specifications
Specification | Status | Comment |
---|---|---|
Feature Policy La définition de 'Feature-Policy' dans cette spécification. |
Brouillon de l'éditeur | Initial definition. Defines the Feature-Policy header. Directives are defined in the specs for the features they control. See individual directive pages for details. |
Browser compatibility
Ordinateur | Mobile | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|
Feature-Policy | Chrome Support complet 60 | Edge Aucun support Non | Firefox
Support complet
65
| IE Aucun support Non | Opera Support complet 47 | Safari
Support partiel
11.1
| WebView Android Support complet 60 | Chrome Android Support complet 60 | Firefox Android
Support complet
65
| Opera Android Support complet 44 | Safari iOS
Support partiel
11.3
| Samsung Internet Android Support complet 8.0 |
accelerometer | Chrome
Support complet
69
| Edge Aucun support Non | Firefox Aucun support Non | IE Aucun support Non | Opera
Support complet
56
| Safari Aucun support Non | WebView Android
Support complet
69
| Chrome Android
Support complet
69
| Firefox Android Aucun support Non | Opera Android
Support complet
48
| Safari iOS Aucun support Non | Samsung Internet Android Aucun support Non |
ambient-light-sensor | Chrome
Support complet
69
| Edge Aucun support Non | Firefox Aucun support Non | IE Aucun support Non | Opera
Support complet
56
| Safari Aucun support Non | WebView Android
Support complet
69
| Chrome Android
Support complet
69
| Firefox Android Aucun support Non | Opera Android
Support complet
48
| Safari iOS Aucun support Non | Samsung Internet Android Aucun support Non |
autoplay | Chrome Support complet 64 | Edge Aucun support Non | Firefox
Support complet
65
| IE Aucun support Non | Opera Support complet 51 | Safari Aucun support Non | WebView Android Support complet 64 | Chrome Android Support complet 64 | Firefox Android
Support complet
65
| Opera Android Support complet 47 | Safari iOS Aucun support Non | Samsung Internet Android Support complet 9.0 |
camera | Chrome Support complet 60 | Edge Aucun support Non | Firefox
Support complet
65
| IE Aucun support Non | Opera Support complet 48 | Safari Support complet 11.1 | WebView Android Support complet 60 | Chrome Android Support complet 60 | Firefox Android
Support complet
65
| Opera Android Support complet 45 | Safari iOS Support complet 11.3 | Samsung Internet Android Support complet 8.0 |
display-capture | Chrome Aucun support Non | Edge Aucun support Non | Firefox
Support complet
67
| IE Aucun support Non | Opera Aucun support Non | Safari Aucun support Non | WebView Android Aucun support Non | Chrome Android Aucun support Non | Firefox Android
Support complet
67
| Opera Android Aucun support Non | Safari iOS Aucun support Non | Samsung Internet Android Aucun support Non |
document-domain | Chrome Support complet 77 | Edge Aucun support Non | Firefox
Support complet
65
| IE Aucun support Non | Opera Support complet 64 | Safari Aucun support Non | WebView Android Aucun support Non | Chrome Android Aucun support Non | Firefox Android
Support complet
65
| Opera Android Aucun support Non | Safari iOS Aucun support Non | Samsung Internet Android Aucun support Non |
encrypted-media | Chrome Support complet 60 | Edge Aucun support Non | Firefox
Support complet
65
| IE Aucun support Non | Opera Support complet 48 | Safari Aucun support Non | WebView Android Support complet 60 | Chrome Android Support complet 60 | Firefox Android
Support complet
65
| Opera Android Support complet 45 | Safari iOS Aucun support Non | Samsung Internet Android Support complet 8.0 |
fullscreen | Chrome Support complet 62 | Edge Aucun support Non | Firefox
Support complet
65
| IE Aucun support Non | Opera Support complet 49 | Safari Aucun support Non | WebView Android Support complet 62 | Chrome Android Support complet 62 | Firefox Android
Support complet
65
| Opera Android Support complet 46 | Safari iOS Aucun support Non | Samsung Internet Android Support complet 8.0 |
geolocation | Chrome Support complet 60 | Edge Aucun support Non | Firefox
Support complet
65
| IE Aucun support Non | Opera Support complet 47 | Safari Aucun support Non | WebView Android Support complet 60 | Chrome Android Support complet 60 | Firefox Android
Support complet
65
| Opera Android Support complet 44 | Safari iOS Aucun support Non | Samsung Internet Android Support complet 8.0 |
gyroscope | Chrome
Support complet
69
| Edge Aucun support Non | Firefox Aucun support Non | IE Aucun support Non | Opera
Support complet
56
| Safari Aucun support Non | WebView Android
Support complet
69
| Chrome Android
Support complet
69
| Firefox Android Aucun support Non | Opera Android
Support complet
48
| Safari iOS Aucun support Non | Samsung Internet Android Aucun support Non |
layout-animations | Chrome Aucun support Non | Edge Aucun support Non | Firefox Aucun support Non | IE Aucun support Non | Opera Aucun support Non | Safari Aucun support Non | WebView Android Aucun support Non | Chrome Android Aucun support Non | Firefox Android Aucun support Non | Opera Android Aucun support Non | Safari iOS Aucun support Non | Samsung Internet Android Aucun support Non |
legacy-image-formats | Chrome
Support complet
68
| Edge Aucun support Non | Firefox Aucun support Non | IE Aucun support Non | Opera
Support complet
55
| Safari Aucun support Non | WebView Android
Support complet
68
| Chrome Android
Support complet
68
| Firefox Android Aucun support Non | Opera Android
Support complet
48
| Safari iOS Aucun support Non | Samsung Internet Android Aucun support Non |
magnetometer | Chrome
Support complet
69
| Edge Aucun support Non | Firefox Aucun support Non | IE Aucun support Non | Opera
Support complet
56
| Safari Aucun support Non | WebView Android
Support complet
69
| Chrome Android
Support complet
69
| Firefox Android Aucun support Non | Opera Android
Support complet
48
| Safari iOS Aucun support Non | Samsung Internet Android Aucun support Non |
microphone | Chrome Support complet 60 | Edge Aucun support Non | Firefox
Support complet
65
| IE Aucun support Non | Opera Support complet 48 | Safari Support complet 11.1 | WebView Android Support complet 60 | Chrome Android Support complet 60 | Firefox Android
Support complet
65
| Opera Android Support complet 45 | Safari iOS Support complet 11.3 | Samsung Internet Android Support complet 8.0 |
midi | Chrome Support complet 60 | Edge Aucun support Non | Firefox
Support complet
65
| IE Aucun support Non | Opera Support complet 47 | Safari Aucun support Non | WebView Android Support complet 60 | Chrome Android Support complet 60 | Firefox Android
Support complet
65
| Opera Android Support complet 44 | Safari iOS Aucun support Non | Samsung Internet Android Support complet 8.0 |
oversized-images | Chrome
Support complet
72
| Edge Aucun support Non | Firefox Aucun support Non | IE Aucun support Non | Opera
Support complet
60
| Safari Aucun support Non | WebView Android
Support complet
72
| Chrome Android
Support complet
72
| Firefox Android Aucun support Non | Opera Android
Support complet
50
| Safari iOS Aucun support Non | Samsung Internet Android Aucun support Non |
payment | Chrome Support complet 60 | Edge Aucun support Non | Firefox
Support complet
65
| IE Aucun support Non | Opera Support complet 47 | Safari Aucun support Non | WebView Android Support complet 60 | Chrome Android Support complet 60 | Firefox Android
Support complet
65
| Opera Android Support complet 44 | Safari iOS Aucun support Non | Samsung Internet Android Support complet 8.0 |
picture-in-picture | Chrome Aucun support Non | Edge Aucun support Non | Firefox Aucun support Non | IE Aucun support Non | Opera Aucun support Non | Safari Aucun support Non | WebView Android Aucun support Non | Chrome Android Aucun support Non | Firefox Android Aucun support Non | Opera Android Aucun support Non | Safari iOS Aucun support Non | Samsung Internet Android Aucun support Non |
speaker | Chrome Support complet 60 | Edge Aucun support Non | Firefox Aucun support Non | IE Aucun support Non | Opera Support complet 48 | Safari Aucun support Non | WebView Android Support complet 60 | Chrome Android Support complet 60 | Firefox Android Aucun support Non | Opera Android Support complet 45 | Safari iOS Aucun support Non | Samsung Internet Android Support complet 8.0 |
sync-xhr | Chrome Support complet 65 | Edge Aucun support Non | Firefox Aucun support Non | IE Aucun support Non | Opera Support complet 52 | Safari Aucun support Non | WebView Android Support complet 65 | Chrome Android Support complet 65 | Firefox Android Aucun support Non | Opera Android Support complet 47 | Safari iOS Aucun support Non | Samsung Internet Android Support complet 9.0 |
unoptimized-images | Chrome
Support complet
72
| Edge Aucun support Non | Firefox Aucun support Non | IE Aucun support Non | Opera
Support complet
60
| Safari Aucun support Non | WebView Android
Support complet
72
| Chrome Android
Support complet
72
| Firefox Android Aucun support Non | Opera Android
Support complet
50
| Safari iOS Aucun support Non | Samsung Internet Android Aucun support Non |
unsized-media | Chrome
Support complet
66
| Edge Aucun support Non | Firefox Aucun support Non | IE Aucun support Non | Opera
Support complet
53
| Safari Aucun support Non | WebView Android
Support complet
66
| Chrome Android
Support complet
66
| Firefox Android Aucun support Non | Opera Android
Support complet
47
| Safari iOS Aucun support Non | Samsung Internet Android Support complet 9.0 |
usb | Chrome Support complet 60 | Edge Aucun support Non | Firefox Aucun support Non | IE Aucun support Non | Opera Support complet 47 | Safari Aucun support Non | WebView Android Support complet 60 | Chrome Android Support complet 60 | Firefox Android Aucun support Non | Opera Android Support complet 44 | Safari iOS Aucun support Non | Samsung Internet Android Support complet 8.0 |
vibrate | Chrome Support complet 60 | Edge Aucun support Non | Firefox Aucun support Non | IE Aucun support Non | Opera Support complet 47 | Safari Aucun support Non | WebView Android Support complet 60 | Chrome Android Support complet 60 | Firefox Android Aucun support Non | Opera Android Support complet 44 | Safari iOS Aucun support Non | Samsung Internet Android Support complet 8.0 |
vr | Chrome Support complet 62 | Edge Aucun support Non | Firefox Aucun support Non | IE Aucun support Non | Opera Support complet 49 | Safari Aucun support Non | WebView Android Support complet 62 | Chrome Android Support complet 62 | Firefox Android Aucun support Non | Opera Android Support complet 46 | Safari iOS Aucun support Non | Samsung Internet Android Support complet 8.0 |
webauthn | Chrome Aucun support Non | Edge Aucun support Non | Firefox Aucun support Non | IE Aucun support Non | Opera Aucun support Non | Safari Aucun support Non | WebView Android Aucun support Non | Chrome Android Aucun support Non | Firefox Android Aucun support Non | Opera Android Aucun support Non | Safari iOS Aucun support Non | Samsung Internet Android Aucun support Non |
Légende
- Support complet
- Support complet
- Support partiel
- Support partiel
- Aucun support
- Aucun support
- Fonctionnalité expérimentale. Celle-ci peut être amenée à changer par la suite.
- Fonctionnalité expérimentale. Celle-ci peut être amenée à changer par la suite.
- Voir les notes d'implémentation.
- Voir les notes d'implémentation.
- Une action explicite de l'utilisateur est nécessaire pour activer cette fonctionnalité.
- Une action explicite de l'utilisateur est nécessaire pour activer cette fonctionnalité.