Feature-Policy

这是一个实验中的功能
此功能某些浏览器尚在开发中,请参考浏览器兼容性表格以得到在不同浏览器中适合使用的前缀。由于该功能对应的标准文档可能被重新修订,所以在未来版本的浏览器中该功能的语法和行为可能随之改变。

 
Feature-Policy响应头提供了一种可以在本页面或包含的iframe上启用或禁止浏览器特性的机制。

更多的信息,请查看Feature Policy

Header type Response header
Forbidden header name yes

语法

Feature-Policy: <directive> <allowlist>

<allowlist>

  • *: 允许在当前文档和所有包含的内容(比如iframes)中使用本特性。
  • 'self': 允许在当前文档中使用本特性,但在包含的内容(比如iframes)仍使用原值。
  • 'src': (只在iframe中允许) 只要在src 中的URL和加载iframe用的URL相同,则本特性在iframe中允许,
  • 'none': 从最上层到包含的内容都禁止本特性。 <origin(s)>: 在特定的源中允许,源URL以空格分割。
  • *: 本特性默认在最上层和包含的内容中(iframes)允许。
  • 'self': 本特性默认在最上层允许,而包含的内容中(iframes)使用源地址相同设定。也就是说本特性在iframe中不允许跨域访问。
  • 'none': 本特性默认在最上层和包含的内容中(iframes)都禁止。

*(在所有源地址启用)'none'(在所有源地址禁用)只允许单独使用,而'self''src'可以与多个源地址一起使用。

所有的特性都有一个如下的默认的allowlist

  • *: 本特性默认在最上层和包含的内容中(iframes)允许。
  • 'self': 本特性默认在最上层允许,而包含的内容中(iframes)使用源地址相同设定。也就是说本特性在iframe中不允许跨域访问。
  • 'none': 本特性默认在最上层和包含的内容中(iframes)都禁止。

指令

autoplay
控制是否允许当前文档自动播放媒体。这种控制是通过接口 HTMLMediaElement 来实现。当这种规则被启用,而且没有用户操作的时候,HTMLMediaElement.play()返回的 Promise会拒绝并抛出一个DOMException异常。在<audio><video>上的autoplay属性会被忽略。
camera
控制是否允许当前文档使用视频输入设备。当这种规则被启用时,MediaDevices.getUserMedia()返回的the Promise会拒绝并抛出错误NotAllowedError。
document-domain
控制是否允许当前文档设置document.domain。当这种规则被启用时,尝试设置document.domain会失败并抛出SecurityError DOMException异常。
encrypted-media
控制是否允许当前文档使用Encrypted Media Extensions API (EME)。当这种规则被启用时,Navigator.requestMediaKeySystemAccess()返回的Promise会拒绝并抛出DOMException异常。
fullscreen
控制是否允许当前文档使用Element.requestFullScreen()。当这种规则被启用时,返回的Promise会拒绝并抛出TypeError
geolocation
控制是否允许当前文档使用Geolocation接口。当这种规则被启用时,调用getCurrentPosition()watchPosition()会返回包含PERMISSION_DENIED的 PositionError
microphone
控制是否允许当前文档使用音频输入设备。当这种规则被启用时,MediaDevices.getUserMedia()返回的the Promise会拒绝并抛出错误NotAllowedError。
midi
控制是否允许当前文档使用Web MIDI API。当这种规则被启用时,Navigator.requestMIDIAccess() 返回的the Promise会拒绝并抛出错误DOMException。
payment
控制是否允许当前文档使用Payment Request API。当这种规则被启用时,构造器PaymentRequest() 会抛出错误SecurityError。
vr / xr
控制是否允许当前文档使用WebVR API。当这种规则被启用时,Navigator.getVRDisplays() 返回的the Promise会拒绝并抛出错误DOMException。

示例

SecureCorp Inc. 公司想要在应用中禁用震动和定位API,则可以在返回的response中传递以下定义feature policy的HTTP的头部信息:

Feature-Policy: vibrate 'none'; geolocation 'none'

通过使用'none'关键词,不管原来如何设定,这些特性在所有浏览的上下文中都会被禁用。

规范

Specification Status Comment
Feature Policy
Feature-Policy
Editor's Draft Initial definition.

浏览器兼容

Update compatibility data on GitHub
DesktopMobile
ChromeEdgeFirefoxInternet ExplorerOperaSafariAndroid webviewChrome for AndroidFirefox for AndroidOpera for AndroidSafari on iOSSamsung Internet
Feature-Policy
Experimental
Chrome Full support 60Edge No support NoFirefox Full support 65
Disabled
Full support 65
Disabled
Disabled From version 65: this feature is behind the dom.security.featurePolicy.header.enabled preference (needs to be set to true). To change preferences in Firefox, visit about:config.
IE No support NoOpera Full support 47Safari Partial support 11.1
Notes
Partial support 11.1
Notes
Notes Only supported through the allow attribute on <iframe> elements.
WebView Android Full support 60Chrome Android Full support 60Firefox Android Full support 65
Disabled
Full support 65
Disabled
Disabled From version 65: this feature is behind the dom.security.featurePolicy.header.enabled preference (needs to be set to true). To change preferences in Firefox, visit about:config.
Opera Android Full support 44Safari iOS Partial support 11.3
Notes
Partial support 11.3
Notes
Notes Only supported through the allow attribute on <iframe> elements.
Samsung Internet Android Full support 8.0
accelerometer
Experimental
Chrome Full support 69
Disabled
Full support 69
Disabled
Disabled From version 69: this feature is behind the #enable-experimental-productivity-features preference (needs to be set to Enabled). To change preferences in Chrome, visit chrome://flags.
Edge No support NoFirefox No support NoIE No support NoOpera Full support 56
Disabled
Full support 56
Disabled
Disabled From version 56: this feature is behind the #enable-experimental-productivity-features preference (needs to be set to Enabled).
Safari No support NoWebView Android Full support 69
Disabled
Full support 69
Disabled
Disabled From version 69: this feature is behind the #enable-experimental-productivity-features preference (needs to be set to Enabled).
Chrome Android Full support 69
Disabled
Full support 69
Disabled
Disabled From version 69: this feature is behind the #enable-experimental-productivity-features preference (needs to be set to Enabled). To change preferences in Chrome, visit chrome://flags.
Firefox Android No support NoOpera Android Full support 48
Disabled
Full support 48
Disabled
Disabled From version 48: this feature is behind the #enable-experimental-productivity-features preference (needs to be set to Enabled).
Safari iOS No support NoSamsung Internet Android No support No
ambient-light-sensor
Experimental
Chrome Full support 69
Disabled
Full support 69
Disabled
Disabled From version 69: this feature is behind the #enable-experimental-productivity-features preference (needs to be set to Enabled). To change preferences in Chrome, visit chrome://flags.
Edge No support NoFirefox No support NoIE No support NoOpera Full support 56
Disabled
Full support 56
Disabled
Disabled From version 56: this feature is behind the #enable-experimental-productivity-features preference (needs to be set to Enabled).
Safari No support NoWebView Android Full support 69
Disabled
Full support 69
Disabled
Disabled From version 69: this feature is behind the #enable-experimental-productivity-features preference (needs to be set to Enabled).
Chrome Android Full support 69
Disabled
Full support 69
Disabled
Disabled From version 69: this feature is behind the #enable-experimental-productivity-features preference (needs to be set to Enabled). To change preferences in Chrome, visit chrome://flags.
Firefox Android No support NoOpera Android Full support 48
Disabled
Full support 48
Disabled
Disabled From version 48: this feature is behind the #enable-experimental-productivity-features preference (needs to be set to Enabled).
Safari iOS No support NoSamsung Internet Android No support No
autoplay
Experimental
Chrome Full support 64Edge No support NoFirefox Full support 65
Disabled
Full support 65
Disabled
Disabled From version 65: this feature is behind the dom.security.featurePolicy.header.enabled preference (needs to be set to true). To change preferences in Firefox, visit about:config.
IE No support NoOpera Full support 51Safari No support NoWebView Android Full support 64Chrome Android Full support 64Firefox Android Full support 65
Disabled
Full support 65
Disabled
Disabled From version 65: this feature is behind the dom.security.featurePolicy.header.enabled preference (needs to be set to true). To change preferences in Firefox, visit about:config.
Opera Android Full support 47Safari iOS No support NoSamsung Internet Android Full support 9.0
camera
Experimental
Chrome Full support 60Edge No support NoFirefox Full support 65
Disabled
Full support 65
Disabled
Disabled From version 65: this feature is behind the dom.security.featurePolicy.header.enabled preference (needs to be set to true). To change preferences in Firefox, visit about:config.
IE No support NoOpera Full support 48Safari Full support 11.1WebView Android Full support 60Chrome Android Full support 60Firefox Android Full support 65
Disabled
Full support 65
Disabled
Disabled From version 65: this feature is behind the dom.security.featurePolicy.header.enabled preference (needs to be set to true). To change preferences in Firefox, visit about:config.
Opera Android Full support 45Safari iOS Full support 11.3Samsung Internet Android Full support 8.0
display-capture
Experimental
Chrome No support NoEdge No support NoFirefox Full support 67
Disabled
Full support 67
Disabled
Disabled From version 67: this feature is behind the dom.security.featurePolicy.header.enabled preference (needs to be set to true). To change preferences in Firefox, visit about:config.
IE No support NoOpera No support NoSafari No support NoWebView Android No support NoChrome Android No support NoFirefox Android Full support 67
Disabled
Full support 67
Disabled
Disabled From version 67: this feature is behind the dom.security.featurePolicy.header.enabled preference (needs to be set to true). To change preferences in Firefox, visit about:config.
Opera Android No support NoSafari iOS No support NoSamsung Internet Android No support No
document-domain
Experimental
Chrome Full support 77Edge No support NoFirefox Full support 65
Disabled
Full support 65
Disabled
Disabled From version 65: this feature is behind the dom.security.featurePolicy.header.enabled preference (needs to be set to true). To change preferences in Firefox, visit about:config.
IE No support NoOpera Full support 64Safari No support NoWebView Android No support NoChrome Android No support NoFirefox Android Full support 65
Disabled
Full support 65
Disabled
Disabled From version 65: this feature is behind the dom.security.featurePolicy.header.enabled preference (needs to be set to true). To change preferences in Firefox, visit about:config.
Opera Android No support NoSafari iOS No support NoSamsung Internet Android No support No
encrypted-media
Experimental
Chrome Full support 60Edge No support NoFirefox Full support 65
Disabled
Full support 65
Disabled
Disabled From version 65: this feature is behind the dom.security.featurePolicy.header.enabled preference (needs to be set to true). To change preferences in Firefox, visit about:config.
IE No support NoOpera Full support 48Safari No support NoWebView Android Full support 60Chrome Android Full support 60Firefox Android Full support 65
Disabled
Full support 65
Disabled
Disabled From version 65: this feature is behind the dom.security.featurePolicy.header.enabled preference (needs to be set to true). To change preferences in Firefox, visit about:config.
Opera Android Full support 45Safari iOS No support NoSamsung Internet Android Full support 8.0
fullscreen
Experimental
Chrome Full support 62Edge No support NoFirefox Full support 65
Disabled
Full support 65
Disabled
Disabled From version 65: this feature is behind the dom.security.featurePolicy.header.enabled preference (needs to be set to true). To change preferences in Firefox, visit about:config.
IE No support NoOpera Full support 49Safari No support NoWebView Android Full support 62Chrome Android Full support 62Firefox Android Full support 65
Disabled
Full support 65
Disabled
Disabled From version 65: this feature is behind the dom.security.featurePolicy.header.enabled preference (needs to be set to true). To change preferences in Firefox, visit about:config.
Opera Android Full support 46Safari iOS No support NoSamsung Internet Android Full support 8.0
geolocation
Experimental
Chrome Full support 60Edge No support NoFirefox Full support 65
Disabled
Full support 65
Disabled
Disabled From version 65: this feature is behind the dom.security.featurePolicy.header.enabled preference (needs to be set to true). To change preferences in Firefox, visit about:config.
IE No support NoOpera Full support 47Safari No support NoWebView Android Full support 60Chrome Android Full support 60Firefox Android Full support 65
Disabled
Full support 65
Disabled
Disabled From version 65: this feature is behind the dom.security.featurePolicy.header.enabled preference (needs to be set to true). To change preferences in Firefox, visit about:config.
Opera Android Full support 44Safari iOS No support NoSamsung Internet Android Full support 8.0
gyroscope
Experimental
Chrome Full support 69
Disabled
Full support 69
Disabled
Disabled From version 69: this feature is behind the #enable-experimental-productivity-features preference (needs to be set to Enabled). To change preferences in Chrome, visit chrome://flags.
Edge No support NoFirefox No support NoIE No support NoOpera Full support 56
Disabled
Full support 56
Disabled
Disabled From version 56: this feature is behind the #enable-experimental-productivity-features preference (needs to be set to Enabled).
Safari No support NoWebView Android Full support 69
Disabled
Full support 69
Disabled
Disabled From version 69: this feature is behind the #enable-experimental-productivity-features preference (needs to be set to Enabled).
Chrome Android Full support 69
Disabled
Full support 69
Disabled
Disabled From version 69: this feature is behind the #enable-experimental-productivity-features preference (needs to be set to Enabled). To change preferences in Chrome, visit chrome://flags.
Firefox Android No support NoOpera Android Full support 48
Disabled
Full support 48
Disabled
Disabled From version 48: this feature is behind the #enable-experimental-productivity-features preference (needs to be set to Enabled).
Safari iOS No support NoSamsung Internet Android No support No
layout-animations
Experimental
Chrome No support NoEdge No support NoFirefox No support NoIE No support NoOpera No support NoSafari No support NoWebView Android No support NoChrome Android No support NoFirefox Android No support NoOpera Android No support NoSafari iOS No support NoSamsung Internet Android No support No
legacy-image-formats
Experimental
Chrome Full support 68
Disabled
Full support 68
Disabled
Disabled From version 68: this feature is behind the #enable-experimental-productivity-features preference (needs to be set to Enabled). To change preferences in Chrome, visit chrome://flags.
Edge No support NoFirefox No support NoIE No support NoOpera Full support 55
Disabled
Full support 55
Disabled
Disabled From version 55: this feature is behind the #enable-experimental-productivity-features preference (needs to be set to Enabled).
Safari No support NoWebView Android Full support 68
Disabled
Full support 68
Disabled
Disabled From version 68: this feature is behind the #enable-experimental-productivity-features preference (needs to be set to Enabled).
Chrome Android Full support 68
Disabled
Full support 68
Disabled
Disabled From version 68: this feature is behind the #enable-experimental-productivity-features preference (needs to be set to Enabled). To change preferences in Chrome, visit chrome://flags.
Firefox Android No support NoOpera Android Full support 48
Disabled
Full support 48
Disabled
Disabled From version 48: this feature is behind the #enable-experimental-productivity-features preference (needs to be set to Enabled).
Safari iOS No support NoSamsung Internet Android No support No
magnetometer
Experimental
Chrome Full support 69
Disabled
Full support 69
Disabled
Disabled From version 69: this feature is behind the #enable-experimental-productivity-features preference (needs to be set to Enabled). To change preferences in Chrome, visit chrome://flags.
Edge No support NoFirefox No support NoIE No support NoOpera Full support 56
Disabled
Full support 56
Disabled
Disabled From version 56: this feature is behind the #enable-experimental-productivity-features preference (needs to be set to Enabled).
Safari No support NoWebView Android Full support 69
Disabled
Full support 69
Disabled
Disabled From version 69: this feature is behind the #enable-experimental-productivity-features preference (needs to be set to Enabled).
Chrome Android Full support 69
Disabled
Full support 69
Disabled
Disabled From version 69: this feature is behind the #enable-experimental-productivity-features preference (needs to be set to Enabled). To change preferences in Chrome, visit chrome://flags.
Firefox Android No support NoOpera Android Full support 48
Disabled
Full support 48
Disabled
Disabled From version 48: this feature is behind the #enable-experimental-productivity-features preference (needs to be set to Enabled).
Safari iOS No support NoSamsung Internet Android No support No
microphone
Experimental
Chrome Full support 60Edge No support NoFirefox Full support 65
Disabled
Full support 65
Disabled
Disabled From version 65: this feature is behind the dom.security.featurePolicy.header.enabled preference (needs to be set to true). To change preferences in Firefox, visit about:config.
IE No support NoOpera Full support 48Safari Full support 11.1WebView Android Full support 60Chrome Android Full support 60Firefox Android Full support 65
Disabled
Full support 65
Disabled
Disabled From version 65: this feature is behind the dom.security.featurePolicy.header.enabled preference (needs to be set to true). To change preferences in Firefox, visit about:config.
Opera Android Full support 45Safari iOS Full support 11.3Samsung Internet Android Full support 8.0
midi
Experimental
Chrome Full support 60Edge No support NoFirefox Full support 65
Disabled
Full support 65
Disabled
Disabled From version 65: this feature is behind the dom.security.featurePolicy.header.enabled preference (needs to be set to true). To change preferences in Firefox, visit about:config.
IE No support NoOpera Full support 47Safari No support NoWebView Android Full support 60Chrome Android Full support 60Firefox Android Full support 65
Disabled
Full support 65
Disabled
Disabled From version 65: this feature is behind the dom.security.featurePolicy.header.enabled preference (needs to be set to true). To change preferences in Firefox, visit about:config.
Opera Android Full support 44Safari iOS No support NoSamsung Internet Android Full support 8.0
oversized-images
Experimental
Chrome Full support 72
Disabled
Full support 72
Disabled
Disabled From version 72: this feature is behind the #enable-experimental-productivity-features preference (needs to be set to Enabled). To change preferences in Chrome, visit chrome://flags.
Edge No support NoFirefox No support NoIE No support NoOpera Full support 60
Disabled
Full support 60
Disabled
Disabled From version 60: this feature is behind the #enable-experimental-productivity-features preference (needs to be set to Enabled).
Safari No support NoWebView Android Full support 72
Disabled
Full support 72
Disabled
Disabled From version 72: this feature is behind the #enable-experimental-productivity-features preference (needs to be set to Enabled).
Chrome Android Full support 72
Disabled
Full support 72
Disabled
Disabled From version 72: this feature is behind the #enable-experimental-productivity-features preference (needs to be set to Enabled). To change preferences in Chrome, visit chrome://flags.
Firefox Android No support NoOpera Android Full support 50
Disabled
Full support 50
Disabled
Disabled From version 50: this feature is behind the #enable-experimental-productivity-features preference (needs to be set to Enabled).
Safari iOS No support NoSamsung Internet Android No support No
payment
Experimental
Chrome Full support 60Edge No support NoFirefox Full support 65
Disabled
Full support 65
Disabled
Disabled From version 65: this feature is behind the dom.security.featurePolicy.header.enabled preference (needs to be set to true). To change preferences in Firefox, visit about:config.
IE No support NoOpera Full support 47Safari No support NoWebView Android Full support 60Chrome Android Full support 60Firefox Android Full support 65
Disabled
Full support 65
Disabled
Disabled From version 65: this feature is behind the dom.security.featurePolicy.header.enabled preference (needs to be set to true). To change preferences in Firefox, visit about:config.
Opera Android Full support 44Safari iOS No support NoSamsung Internet Android Full support 8.0
picture-in-picture
Experimental
Chrome No support NoEdge No support NoFirefox No support NoIE No support NoOpera No support NoSafari No support NoWebView Android No support NoChrome Android No support NoFirefox Android No support NoOpera Android No support NoSafari iOS No support NoSamsung Internet Android No support No
speaker
Experimental
Chrome Full support 60Edge No support NoFirefox No support NoIE No support NoOpera Full support 48Safari No support NoWebView Android Full support 60Chrome Android Full support 60Firefox Android No support NoOpera Android Full support 45Safari iOS No support NoSamsung Internet Android Full support 8.0
sync-xhr
Experimental
Chrome Full support 65Edge No support NoFirefox No support NoIE No support NoOpera Full support 52Safari No support NoWebView Android Full support 65Chrome Android Full support 65Firefox Android No support NoOpera Android Full support 47Safari iOS No support NoSamsung Internet Android Full support 9.0
unoptimized-images
Experimental
Chrome Full support 72
Disabled
Full support 72
Disabled
Disabled From version 72: this feature is behind the #enable-experimental-productivity-features preference (needs to be set to Enabled). To change preferences in Chrome, visit chrome://flags.
Edge No support NoFirefox No support NoIE No support NoOpera Full support 60
Disabled
Full support 60
Disabled
Disabled From version 60: this feature is behind the #enable-experimental-productivity-features preference (needs to be set to Enabled).
Safari No support NoWebView Android Full support 72
Disabled
Full support 72
Disabled
Disabled From version 72: this feature is behind the #enable-experimental-productivity-features preference (needs to be set to Enabled).
Chrome Android Full support 72
Disabled
Full support 72
Disabled
Disabled From version 72: this feature is behind the #enable-experimental-productivity-features preference (needs to be set to Enabled). To change preferences in Chrome, visit chrome://flags.
Firefox Android No support NoOpera Android Full support 50
Disabled
Full support 50
Disabled
Disabled From version 50: this feature is behind the #enable-experimental-productivity-features preference (needs to be set to Enabled).
Safari iOS No support NoSamsung Internet Android No support No
unsized-media
Experimental
Chrome Full support 66
Disabled
Full support 66
Disabled
Disabled From version 66: this feature is behind the #enable-experimental-productivity-features preference (needs to be set to Enabled). To change preferences in Chrome, visit chrome://flags.
Edge No support NoFirefox No support NoIE No support NoOpera Full support 53
Disabled
Full support 53
Disabled
Disabled From version 53: this feature is behind the #enable-experimental-productivity-features preference (needs to be set to Enabled).
Safari No support NoWebView Android Full support 66
Disabled
Full support 66
Disabled
Disabled From version 66: this feature is behind the #enable-experimental-productivity-features preference (needs to be set to Enabled).
Chrome Android Full support 66
Disabled
Full support 66
Disabled
Disabled From version 66: this feature is behind the #enable-experimental-productivity-features preference (needs to be set to Enabled). To change preferences in Chrome, visit chrome://flags.
Firefox Android No support NoOpera Android Full support 47
Disabled
Full support 47
Disabled
Disabled From version 47: this feature is behind the #enable-experimental-productivity-features preference (needs to be set to Enabled).
Safari iOS No support NoSamsung Internet Android Full support 9.0
usb
Experimental
Chrome Full support 60Edge No support NoFirefox No support NoIE No support NoOpera Full support 47Safari No support NoWebView Android Full support 60Chrome Android Full support 60Firefox Android No support NoOpera Android Full support 44Safari iOS No support NoSamsung Internet Android Full support 8.0
vibrate
Experimental
Chrome Full support 60Edge No support NoFirefox No support NoIE No support NoOpera Full support 47Safari No support NoWebView Android Full support 60Chrome Android Full support 60Firefox Android No support NoOpera Android Full support 44Safari iOS No support NoSamsung Internet Android Full support 8.0
vr
Experimental
Chrome Full support 62Edge No support NoFirefox No support NoIE No support NoOpera Full support 49Safari No support NoWebView Android Full support 62Chrome Android Full support 62Firefox Android No support NoOpera Android Full support 46Safari iOS No support NoSamsung Internet Android Full support 8.0
webauthn
Experimental
Chrome No support NoEdge No support NoFirefox No support NoIE No support NoOpera No support NoSafari No support NoWebView Android No support NoChrome Android No support NoFirefox Android No support NoOpera Android No support NoSafari iOS No support NoSamsung Internet Android No support No

Legend

Full support  
Full support
Partial support  
Partial support
No support  
No support
Experimental. Expect behavior to change in the future.
Experimental. Expect behavior to change in the future.
See implementation notes.
See implementation notes.
User must explicitly enable this feature.
User must explicitly enable this feature.

参见