webzod
account

Fix the Permissions-Policy syntax

headers.permissions.invalid · effort: minutes

Why it matters

Browsers ignore entries that do not follow the structured header syntax, so the features they were meant to switch off stay available. The usual cause is the old Feature-Policy syntax under the new header name.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

  1. Write each entry as feature=(allowlist): () for nobody, (self) for your own origin, origins in double quotes inside the parentheses, * for everyone. self is written without quotes.
  2. Separate entries with commas, then test the pages that use those features after deploying.
text 
# ignored (Feature-Policy syntax)
Permissions-Policy: camera 'none'; geolocation 'self'
# works
Permissions-Policy: camera=(), geolocation=(self)

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.