Feature-Policy

The HTTP Feature-Policy header  provides a mechanism to allow and deny the use of browser features in its own frame, and in iframes that it embeds.

For more information, see the main Feature Policy article.

Syntax

Feature-Policy: <directive> <allowlist>

<allowlist>

The allowlist is a list of origins that takes one of the following values:

• *: The feature is allowed by default in top-level browsing contexts and all nested browsing contexts (iframes).
• 'self': (Default) The feature is allowed by default in top-level browsing contexts and in nested browsing contexts (iframes) in the same origin. The feature is not allowed in cross-origin documents in nested browsing contexts.
• 'none': The feature is disabled in top-level and nested browsing contexts.
• <origin(s)>: The feature is allowed for specific origins (for example, https://example.com). Origins should be separated by a space.

The values * (enable for all origins) or 'none' (disable for all origins) may only be used alone, while 'self' may be used with one or more origins.

Directives

fullscreen

Controls whether the current document is allowed to use Element.requestFullScreen(). When this policy is enabled, the returned Promise rejects with a TypeError.

geolocation

Controls whether the current document is allowed to use the Geolocation Interface. When this policy is enabled, calls to getCurrentPosition() and watchPosition() will cause those functions' callbacks to be invoked with a PositionError code of PERMISSION_DENIED.

microphone

Controls whether the current document is allowed to use audio input devices. When this policy is enabled, the Promise returned by MediaDevices.getUserMedia() will reject with a NotAllowedError.

Example

SecureCorp Inc. wants to disable Vibration and Geolocation APIs in their application. It can do so by delivering the following HTTP response header to define a feature policy:

Feature-Policy: vibrate 'none'; geolocation 'none'

By specifying the 'none' keyword for the origin list, the specified features will be disabled for all browsing contexts, regardless of their origin.

Specifications

Browser compatibility