I'm checking the options to harden my web app by setting the appropriate HTTP headers.

Besides the Content Security Policy (CSP) there are two another approaches: Document Policy and Permissions-Policy (Feature-Policy).

I've checked the W3C Relation to Feature Policy documentation, but still can't grasp the clear answer wherever I need to set both policies: Document and Permissions or it is overshooting and it's enough to set just Permissions-Policy?

P.S. Feel free to forward this question to the SE's Web Applications or StackOverflow portals, if the question doesn't fit so much this portal.

1 Answer 1


Document-Poicy is for more performance/best-practice options. Permissions-Policy is for handling "powerful" features that you don't want third-parties or new devs using.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.