6

From the spec at https://www.w3.org/TR/permissions-policy-1/ it seems there is no way to whitelist features with a default blacklist, and each feature must be individually disabled in every single request - adding a few Kb to every complete page load after all assets are fetched:

Permissions-Policy: accelerometer=(),autoplay=(),camera=(),display-capture=(),document-domain=(),encrypted-media=(),fullscreen=(),geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),picture-in-picture=(),publickey-credentials-get=(),screen-wake-lock=(),sync-xhr=(self),usb=(),web-share=(),xr-spatial-tracking=()

https://securityheaders.com has added this header to the base checklist. It looks like it could be a fair amount of extra traffic for not a lot of benefit (the user will be prompted for feature access anyway).

Is there any best practice (or general consensus) on how/if to use this header when no features are required?

1
  • 2
    Mozilla seems to recommend explicitly blacklisting as best practice in developer.mozilla.org/en-US/docs/Web/HTTP/Feature_Policy/… ("For new content, you can start developing with a policy that disables all the features. This approach ensures that none of the functionality is introduced. When applying a policy to existing content, testing is likely required to verify it continues to work as expected.") Commented Jan 19, 2022 at 16:12

1 Answer 1

0

The ratio behind using a blocklist instead of an allowlist is that this is a defence-in-depth measure, just like CSP.

Your browser contains a lot of features. You as a website operator know which features you do not use. Normally, these features would never be activated since you did not implement them. But in case of a different flaw, an XSS vulnerability for instance, certain features might get activated.

As a second line of defence, the Permissions-Policy header could be used to disable specific features entirely, meaning that while the XSS vulnerability remains, the attacker would not be able to enable these features.

Thus, blocklisting the features that you will not use is the best practise, while keeping in mind this is only a secondary line of defence.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .