Permissions-Policy

The Feature-Policy header has been deprecated in favor of Permissions-Policy and Document-Policy. I think it’s too early to decide what Helmet should do with these headers, but I wanted to make an issue to track it.

See https://github.com/helmetjs/feature-policy/issues/10 for a little more discussion.

[EvanHahn]

I’m not yet ready to add Permissions Policy support to Helmet. The specification is still in flux.

For now, here are some options:

• Write a very simple middleware yourself. Here’s an example:

  app.use((req, res, next) => {
    res.setHeader(
      "Permissions-Policy",
      "geolocation=(), interest-cohort=()"
    );
    next();
  });
  

• Install the permissions-policy package. This package is not maintained by me but is a fork of a Helmet module and I have contributed a few changes. This package, or something like it, may eventually be included in a future Helmet version.

• If your only goal is to block FLoC, I just published the floc-block package and a blog post showing how to disable it.

Hope this helps!

[EvanHahn]

@Cherry Thanks for the update here. Based on this, I’m going to do a few things (nothing too big):

• Create a new issue for Document-Policy (#258)
• Update this issue to be about Permissions-Policy, specifically

Browser support for Permissions-Policy is basically nil, but I’ll keep an eye on this as the header is rolled out. It’ll almost certainly be disabled in Helmet by default.

For now, here’s a simple example showing how to use Permissions-Policy with Express:

app.use((req, res, next) => {
  res.setHeader(
    "Permissions-Policy",
    'geolocation=(self "https://example.com"), microphone=()'
  );
  next();
});