Guide to Setting the "Permissions-Policy" Header

Contents

What Does This Header Do?

The Permissions-Policy header allows you to control which browser features (e.g., camera, microphone, geolocation) are permitted on your website. This helps mitigate potential abuse by restricting unnecessary access to sensitive user data or hardware capabilities.

Steps to Set the Header

1. If You Use a Web Server (e.g., Apache, Nginx, etc.)

For Apache:

  1. Open your website's configuration file (or .htaccess file if you use one).
  2. Add the following line, replacing the policies with those applicable to your needs: 
    Header set Permissions-Policy "geolocation=(), microphone=(), camera=()"
  3. Save the file and restart the Apache server to apply changes.

For Nginx:

  1. Open your website's configuration file (e.g., /etc/nginx/sites-available/your-site).
  2. Add the following line inside the server block, replacing the policies with those applicable to your needs: 
    add_header Permissions-Policy "geolocation=(), microphone=(), camera=()";
  3. Save the file and restart Nginx to apply changes using: 
    sudo systemctl restart nginx

2. If You Use a Programming Language:

For PHP:

header("Permissions-Policy: geolocation=(), microphone=(), camera=()");

For Node.js:

Set it manually, or use the permissions policy middleware that matches your framework version.

app.use((req, res, next) => {
  res.setHeader('Permissions-Policy', 'geolocation=(), microphone=(), camera=()');
  next();
});

For Python (Flask):

from flask import Flask, Response

app = Flask(__name__)

@app.after_request
def set_headers(response):
    response.headers['Permissions-Policy'] = 'geolocation=(), microphone=(), camera=()'
    return response

3. Verify the Header

After setting the header, test your website to ensure it’s working:

  1. Open your website in a browser.
  2. Use the developer tools (right-click > Inspect > Network tab) to view the HTTP headers.
  3. Look for the Permissions-Policy header with the correct value.

Why It Matters

Setting this header helps protect user privacy by limiting access to sensitive browser features, reducing the risk of misuse by malicious or untrusted content.