Feature Policy allows web developers to selectively enable, disable, and modify the behavior of certain features and APIs in the browser. It is similar to Content Security Policy but controls features instead of security behavior.
The Feature-Policy
header has now been renamed to Permissions-Policy
in the spec, and this article will eventually be updated to reflect that change.
In a nutshell
Feature Policy provides a mechanism to explicitly declare what functionality is used (or not used), throughout your website. This allows you to lock in best practices, even as the codebase evolves over time — as well as to more safely compose third-party content — by limiting which features are available.
With Feature Policy, you opt-in to a set of "policies" for the browser to enforce on specific features used throughout a website. These policies restrict what APIs the site can access or modify the browser's default behavior for certain features.
Examples of what you can do with Feature Policy:
- Change the default behavior of autoplay on mobile and third party videos.
- Restrict a site from using sensitive APIs like camera or microphone.
- Allow iframes to use the fullscreen API.
- Block the use of outdated APIs like synchronous XHR and
document.write()
. - Ensure images are sized properly and are not too big for the viewport.
Concepts and usage
Feature Policy allows you to control which origins can use which features, both in the top-level page and in embedded frames. Essentially, you write a policy, which is an allowed list of origins for each feature. For every feature controlled by Feature Policy, the feature is only enabled in the current document or frame if its origin matches the allowed list of origins.
For each policy-controlled feature, the browser maintains a list of origins for which the feature is enabled, known as an allowlist. If you do not specify a policy for a feature, then a default allowlist will be used. The default allowlist is specific to each feature.
Writing a policy
A policy is described using a set of individual policy directives. A policy directive is a combination of a defined feature name, and an allowlist of origins that can use the feature.
Specifying your policy
Feature Policy provides two ways to specify policies to control features:
- The
Feature-Policy
HTTP header. - The
allow
attribute on iframes.
The primary difference between the HTTP header and the allow
attribute is that the allow attribute only controls features within an iframe. The header controls features in the response and any embedded content within the page.
For more details see Using Feature Policy.
Inferring the policy
Scripts can programatically query information about the feature policy via the FeaturePolicy
object located at either Document.featurePolicy
or HTMLIFrameElement.featurePolicy
.
Types of policy-controlled features
Though Feature Policy provides control of multiple features using a consistent syntax, the behavior of policy controlled features varies and depends on several factors.
The general principle is that there should be an intuitive or non-breaking way for web developers to detect or handle the case when the feature is disabled. Newly introduced features may have an explicit API to signal the state. Existing features that later integrate with Feature Policy will typically use existing mechanisms. Some approaches include:
- Return "permission denied" for JavaScript APIs that require user permission grants.
- Return
false
or error from an existing JavaScript API that provides access to feature. - Change the default values or options that control the feature behavior.
The current set of policy-controlled features fall into two broad categories:
- Enforcing best practices for good user experiences.
- Providing granular control over sensitive or powerful features.
Best practices for good user experiences
There are several policy-controlled features to help enforce best practices for providing good performance and user experiences.
In most cases, the policy-controlled features represent functionality that when used will negatively impact the user experience. To avoid breaking existing web content, the default for such policy-controlled features is to allow the functionality to be used by all origins. Best practices are then enforced by using policies that disable the policy-controlled features. For more details see "Enforcing best practices for good user experiences".
The features include:
- Layout-inducing animations
- Legacy image formats
- Oversized images
- Synchronous scripts
- Synchronous XMLHTTPRequest
- Unoptimized images
- Unsized media
Granular control over certain features
The web provides functionality and APIs that may have privacy or security risks if abused. In some cases, you may wish to strictly limit how such functionality is used on a website. There are policy-controlled features to allow functionality to be enabled/disabled for specific origins or frames within a website. Where available, the feature integrates with the Permissions API, or feature-specific mechanisms to check if the feature is available.
The features include (see Features list):
- Accelerometer
- Ambient light sensor
- Autoplay
- Camera
- Encrypted media
- Fullscreen
- Geolocation
- Gyroscope
- Magnetometer
- Microphone
- Midi
- PaymentRequest
- Picture-in-picture
- USB
- VR / XR
Examples
- Using Feature Policy
- See Feature Policy Demos for example usage of many policies.
Specifications
Specification | Status | Comment |
---|---|---|
Feature Policy The definition of 'Feature-Policy' in that specification. |
Editor's Draft | Initial definition. Defines the Feature-Policy header. Directives are defined in the specs for the features they control. See individual directive pages for details. |
Browser compatibility
Desktop | Mobile | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|
Feature-Policy | Chrome Full support 60 | Edge Full support 79 | Firefox
Full support
74
| IE No support No | Opera Full support 47 | Safari
Partial support
11.1
| WebView Android Full support 60 | Chrome Android Full support 60 | Firefox Android
Full support
65
| Opera Android Full support 44 | Safari iOS
Partial support
11.3
| Samsung Internet Android Full support 8.0 |
accelerometer | Chrome
Full support
69
| Edge
Full support
79
| Firefox No support No | IE No support No | Opera
Full support
56
| Safari No support No | WebView Android No support No | Chrome Android
Full support
69
| Firefox Android No support No | Opera Android
Full support
48
| Safari iOS No support No | Samsung Internet Android No support No |
ambient-light-sensor | Chrome
Full support
69
| Edge
Full support
79
| Firefox No support No | IE No support No | Opera
Full support
56
| Safari No support No | WebView Android No support No | Chrome Android
Full support
69
| Firefox Android No support No | Opera Android
Full support
48
| Safari iOS No support No | Samsung Internet Android No support No |
autoplay | Chrome Full support 64 | Edge Full support 79 | Firefox
Full support
74
| IE No support No | Opera Full support 51 | Safari No support No | WebView Android Full support 64 | Chrome Android Full support 64 | Firefox Android
Full support
65
| Opera Android Full support 47 | Safari iOS No support No | Samsung Internet Android Full support 9.0 |
battery | Chrome
No support
No
| Edge
No support
No
| Firefox No support No | IE No support No | Opera No support No | Safari No support No | WebView Android No support No | Chrome Android
No support
No
| Firefox Android No support No | Opera Android No support No | Safari iOS No support No | Samsung Internet Android No support No |
camera | Chrome Full support 60 | Edge Full support 79 | Firefox
Full support
74
| IE No support No | Opera Full support 48 | Safari Full support 11.1 | WebView Android Full support 60 | Chrome Android Full support 60 | Firefox Android
Full support
65
| Opera Android Full support 45 | Safari iOS Full support 11.3 | Samsung Internet Android Full support 8.0 |
display-capture | Chrome No support No | Edge No support No | Firefox
Full support
74
| IE No support No | Opera No support No | Safari No support No | WebView Android No support No | Chrome Android No support No | Firefox Android
Full support
67
| Opera Android No support No | Safari iOS No support No | Samsung Internet Android No support No |
document-domain | Chrome Full support 77 | Edge Full support 79 | Firefox
Full support
74
| IE No support No | Opera Full support 64 | Safari No support No | WebView Android No support No | Chrome Android No support No | Firefox Android
Full support
65
| Opera Android No support No | Safari iOS No support No | Samsung Internet Android No support No |
encrypted-media | Chrome Full support 60 | Edge Full support 79 | Firefox
Full support
74
| IE No support No | Opera Full support 48 | Safari No support No | WebView Android Full support 60 | Chrome Android Full support 60 | Firefox Android
Full support
65
| Opera Android Full support 45 | Safari iOS No support No | Samsung Internet Android Full support 8.0 |
fullscreen | Chrome Full support 62 | Edge Full support 79 | Firefox
Full support
74
| IE No support No | Opera Full support 49 | Safari No support No | WebView Android Full support 62 | Chrome Android Full support 62 | Firefox Android
Full support
65
| Opera Android Full support 46 | Safari iOS No support No | Samsung Internet Android Full support 8.0 |
geolocation | Chrome Full support 60 | Edge Full support 79 | Firefox
Full support
74
| IE No support No | Opera Full support 47 | Safari No support No | WebView Android Full support 60 | Chrome Android Full support 60 | Firefox Android
Full support
65
| Opera Android Full support 44 | Safari iOS No support No | Samsung Internet Android Full support 8.0 |
gyroscope | Chrome
Full support
69
| Edge
Full support
79
| Firefox No support No | IE No support No | Opera
Full support
56
| Safari No support No | WebView Android No support No | Chrome Android
Full support
69
| Firefox Android No support No | Opera Android
Full support
48
| Safari iOS No support No | Samsung Internet Android No support No |
layout-animations | Chrome No support No | Edge No support No | Firefox No support No | IE No support No | Opera No support No | Safari No support No | WebView Android No support No | Chrome Android No support No | Firefox Android No support No | Opera Android No support No | Safari iOS No support No | Samsung Internet Android No support No |
legacy-image-formats | Chrome
Full support
68
| Edge
Full support
79
| Firefox No support No | IE No support No | Opera
Full support
55
| Safari No support No | WebView Android No support No | Chrome Android
Full support
68
| Firefox Android No support No | Opera Android
Full support
48
| Safari iOS No support No | Samsung Internet Android No support No |
magnetometer | Chrome
Full support
69
| Edge
Full support
79
| Firefox No support No | IE No support No | Opera
Full support
56
| Safari No support No | WebView Android No support No | Chrome Android
Full support
69
| Firefox Android No support No | Opera Android
Full support
48
| Safari iOS No support No | Samsung Internet Android No support No |
microphone | Chrome Full support 60 | Edge Full support 79 | Firefox
Full support
74
| IE No support No | Opera Full support 48 | Safari Full support 11.1 | WebView Android Full support 60 | Chrome Android Full support 60 | Firefox Android
Full support
65
| Opera Android Full support 45 | Safari iOS Full support 11.3 | Samsung Internet Android Full support 8.0 |
midi | Chrome Full support 60 | Edge Full support 79 | Firefox
Full support
74
| IE No support No | Opera Full support 47 | Safari No support No | WebView Android Full support 60 | Chrome Android Full support 60 | Firefox Android
Full support
65
| Opera Android Full support 44 | Safari iOS No support No | Samsung Internet Android Full support 8.0 |
oversized-images | Chrome
Full support
72
| Edge
Full support
79
| Firefox No support No | IE No support No | Opera
Full support
60
| Safari No support No | WebView Android No support No | Chrome Android
Full support
72
| Firefox Android No support No | Opera Android
Full support
50
| Safari iOS No support No | Samsung Internet Android No support No |
payment | Chrome Full support 60 | Edge Full support 79 | Firefox
Full support
74
| IE No support No | Opera Full support 47 | Safari No support No | WebView Android Full support 60 | Chrome Android Full support 60 | Firefox Android
Full support
65
| Opera Android Full support 44 | Safari iOS No support No | Samsung Internet Android Full support 8.0 |
picture-in-picture | Chrome No support No | Edge No support No | Firefox No support No | IE No support No | Opera No support No | Safari No support No | WebView Android No support No | Chrome Android No support No | Firefox Android No support No | Opera Android No support No | Safari iOS No support No | Samsung Internet Android No support No |
publickey-credentials-get | Chrome Full support 84 | Edge Full support 84 | Firefox No support No | IE No support No | Opera No support No | Safari No support No | WebView Android Full support 84 | Chrome Android Full support 84 | Firefox Android No support No | Opera Android No support No | Safari iOS No support No | Samsung Internet Android No support No |
sync-xhr | Chrome Full support 65 | Edge Full support 79 | Firefox No support No | IE No support No | Opera Full support 52 | Safari No support No | WebView Android Full support 65 | Chrome Android Full support 65 | Firefox Android No support No | Opera Android Full support 47 | Safari iOS No support No | Samsung Internet Android Full support 9.0 |
unoptimized-images | Chrome
Full support
72
| Edge
Full support
79
| Firefox No support No | IE No support No | Opera
Full support
60
| Safari No support No | WebView Android No support No | Chrome Android
Full support
72
| Firefox Android No support No | Opera Android
Full support
50
| Safari iOS No support No | Samsung Internet Android No support No |
unsized-media | Chrome
Full support
66
| Edge
Full support
79
| Firefox No support No | IE No support No | Opera
Full support
53
| Safari No support No | WebView Android No support No | Chrome Android
Full support
66
| Firefox Android No support No | Opera Android
Full support
47
| Safari iOS No support No | Samsung Internet Android Full support 9.0 |
usb | Chrome Full support 60 | Edge Full support 79 | Firefox No support No | IE No support No | Opera Full support 47 | Safari No support No | WebView Android Full support 60 | Chrome Android Full support 60 | Firefox Android No support No | Opera Android Full support 44 | Safari iOS No support No | Samsung Internet Android Full support 8.0 |
vibrate | Chrome No support No | Edge No support No | Firefox No support No | IE No support No | Opera No support No | Safari No support No | WebView Android No support No | Chrome Android No support No | Firefox Android No support No | Opera Android No support No | Safari iOS No support No | Samsung Internet Android No support No |
wake-lock | Chrome No support No | Edge No support No | Firefox No support No | IE No support No | Opera No support No | Safari No support No | WebView Android No support No | Chrome Android No support No | Firefox Android No support No | Opera Android No support No | Safari iOS No support No | Samsung Internet Android No support No |
xr-spatial-tracking | Chrome Full support 79 | Edge Full support 79 | Firefox No support No | IE No support No | Opera Full support 66 | Safari No support No | WebView Android No support No | Chrome Android Full support 79 | Firefox Android No support No | Opera Android No support No | Safari iOS No support No | Samsung Internet Android No support No |
Legend
- Full support
- Full support
- Partial support
- Partial support
- No support
- No support
- Experimental. Expect behavior to change in the future.
- Experimental. Expect behavior to change in the future.
- Non-standard. Expect poor cross-browser support.
- Non-standard. Expect poor cross-browser support.
- Deprecated. Not for use in new websites.
- Deprecated. Not for use in new websites.
- See implementation notes.
- See implementation notes.
- User must explicitly enable this feature.
- User must explicitly enable this feature.