Permissions-Policy: turning browser features off by default

The header is a comma separated list of feature names, each followed by an allowlist in parentheses. An empty list turns the feature off for the document and everything it embeds. The token self means the document origin only, a quoted URL adds one specific origin, and the star token allows everyone, which is almost never what you want for a feature such as microphone.

The point is defence against code you did not write. An advertisement iframe, a chat widget or an embedded map inherits your page's permissions unless a policy says otherwise, and a permission prompt raised by a third party script still carries your site's name. Disabling every feature the application does not use costs one header line and removes that whole class of surprise.

The syntax deliberately differs from the Feature-Policy header it replaced. Feature-Policy separated features with semicolons and wrote origins unquoted; Permissions-Policy uses commas and quotes origins as strings. Sending both is harmless if they agree, but copying old Feature-Policy syntax into the new header produces a value the browser cannot parse and therefore ignores.

Feature names track browser capabilities rather than a stable registry, so a name your browser does not recognise is skipped silently instead of invalidating the policy. That makes the header safe to over-specify: listing a feature some browser has not implemented does not affect the rest of the list.