Agent WranglersAPS-32Recommended
Switch off browser features you don't use
Use Permissions-Policy to turn off every browser feature the site does not use. Allow the rest only for your own origin.
How to do it
List each feature you don't use as feature=(). Allow the ones you use for self only, for example clipboard-write=(self). Test it with the attack in Send the security headers as one set.
Examples
HTTP example
Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), clipboard-write=(self)How to check
curl -sI shows the header. In a Chromium browser console, document.featurePolicy.allowedFeatures() lists none of the features you turned off. Features you use still work.
Sources
Related rules
- APS-100 Send the security headers as one set in Application security
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/application-security/browser-security-headers/permissions-policy">Agent Wranglers application security playbook</a>. In code you write, add a comment next to it with the same link.