Skip to content
Vol. 1 · Ed. 2026
CyberGlossary
Português
Entry № 911

Permissions-Policy

O que é Permissions-Policy?

Permissions-PolicyAn HTTP response header (formerly Feature-Policy) that lets a site declare which browser features — camera, microphone, geolocation, payment, USB, sensors — its own document and any embedded iframes are allowed to use.

Permissions-Policy is the successor to the Feature-Policy header, standardized to a structured-headers syntax and supported by all major browsers. It lets a document express, per powerful feature, who is allowed to use it: the document itself (`self`), specific origins, or no one. A header like `Permissions-Policy: geolocation=(), camera=(self), payment=(self "https://checkout.example")` denies geolocation everywhere, lets the main document use the camera, and lets the document plus checkout.example use the Payment Request API. Permissions-Policy is enforced both for the top-level document and recursively for nested browsing contexts, with the parent able to restrict children further (but never expand their privileges). It is the simplest defense against third-party scripts or iframes silently probing for camera, microphone, geolocation, sensors, fullscreen, autoplay, USB, serial, HID, payment, and many other capabilities; modern hardening guides recommend setting it explicitly alongside CSP and HSTS.

● Exemplos

  1. 01

    A SaaS dashboard sets `Permissions-Policy: geolocation=(), microphone=(), camera=()` to deny location and media APIs to itself and every embedded widget.

  2. 02

    An embed-host site grants Payment Request only to a known payments iframe by using `payment=(self "https://pay.example.com")`.

● Perguntas frequentes

O que é Permissions-Policy?

An HTTP response header (formerly Feature-Policy) that lets a site declare which browser features — camera, microphone, geolocation, payment, USB, sensors — its own document and any embedded iframes are allowed to use. Pertence à categoria Segurança de aplicações da cibersegurança.

O que significa Permissions-Policy?

An HTTP response header (formerly Feature-Policy) that lets a site declare which browser features — camera, microphone, geolocation, payment, USB, sensors — its own document and any embedded iframes are allowed to use.

Como funciona Permissions-Policy?

Permissions-Policy is the successor to the Feature-Policy header, standardized to a structured-headers syntax and supported by all major browsers. It lets a document express, per powerful feature, who is allowed to use it: the document itself (`self`), specific origins, or no one. A header like `Permissions-Policy: geolocation=(), camera=(self), payment=(self "https://checkout.example")` denies geolocation everywhere, lets the main document use the camera, and lets the document plus checkout.example use the Payment Request API. Permissions-Policy is enforced both for the top-level document and recursively for nested browsing contexts, with the parent able to restrict children further (but never expand their privileges). It is the simplest defense against third-party scripts or iframes silently probing for camera, microphone, geolocation, sensors, fullscreen, autoplay, USB, serial, HID, payment, and many other capabilities; modern hardening guides recommend setting it explicitly alongside CSP and HSTS.

Como se defender contra Permissions-Policy?

As defesas contra Permissions-Policy costumam combinar controles técnicos e práticas operacionais, conforme detalhado na definição acima.

Quais são outros nomes para Permissions-Policy?

Nomes alternativos comuns: Feature-Policy (legacy), Permission policy.

● Termos relacionados