Safety
Feature-Policy vs Permissions-Policy for Device APIs
October 18, 2023
Feature-Policy vs Permissions-Policy is the same job under a new header name. Feature-Policy was the experimental name. Permissions-Policy is the standardized header that tells the browser which powerful APIs this document (and its iframes) may use. Public marketing sites almost never need camera, microphone, geolocation, or payment — turn them off with Permissions-Policy. Shipping only Feature-Policy is a fossil; shipping neither is an open invitation for a third-party script to prompt. RoastMyOpsec's free header pack looks for Permissions-Policy on the primary HTML response. It does not prompt for devices and it does not treat a leftover Feature-Policy as a complete substitute.
The practical difference
Syntax moved. Feature-Policy used a different grammar; Permissions-Policy uses a structured-header allowlist (for example camera=(), geolocation=()). Directives overlap but are not a copy-paste. A CDN rule that still emits Feature-Policy only may do nothing useful in current Chrome.
iframe allow= attributes are a third control. They do not replace a document-wide Permissions-Policy on the parent marketing page.
How to choose what to ship
Set Permissions-Policy to disable unused powerful features on HTML. Keep Feature-Policy only as a temporary dual-send if you still have ancient browsers you care about — then delete it. If a checkout iframe truly needs payment, allow it on that route only, not on the homepage.
| Header | Status | What to do | Takeaway |
|---|---|---|---|
| Permissions-Policy | Current | Disable camera, mic, geo, payment unless needed | This is the one the roast grades |
| Feature-Policy | Legacy name | Do not rely on it alone | Migrate; dual-send only briefly |
| iframe allow= | Per-frame | Tighten embeds, still set document policy | Not a homepage substitute |
| Neither | Browser defaults | Third-party tags can still request APIs | Fix this week |
What the roast can see
Presence of Permissions-Policy on the document. A Feature-Policy-only response can still look empty to that check. Pair with the device-API guide for which features to disable.
Common mistakes
The first mistake is copying a 2018 Feature-Policy snippet and calling it done.
The second mistake is allowing geolocation=* on the brochure because a store locator might need it one day.
The third mistake is Permissions-Policy on the API host and not on www HTML.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Is Feature-Policy still required?
- No. Prefer Permissions-Policy. Dual-send only if you have a documented old-browser requirement, then remove Feature-Policy.
- Does RoastMyOpsec grade Feature-Policy?
- The free header pack looks for Permissions-Policy. Confirm both at the CDN if you still emit the old name.
- Will disabling camera break my site?
- Not if the page never used it. Store locators that need geolocation should allow it on that route, not the whole marketing origin.