Estudio de Permissions-Policy (Feature-Policy)

Configura y genera cabeceras HTTP Permissions-Policy según el estándar W3C para controlar el acceso a hardware y APIs del navegador

Plantillas de Políticas

Carga perfiles de seguridad recomendados para aplicaciones web

Directivas de Hardware y Funciones del Navegador

Configura privilegios de ejecución para subsistemas del navegador

15 bloqueado

1 permitido

Multimedia y Captura de Pantalla

camera

Access video input devices like webcams

microphone

Access audio input devices like microphones

speaker-selection

Enumerate and select audio output devices

display-capture

Capture contents of the screen or display surfaces

Sensores y Geolocalización

geolocation

Access geographic location coordinates

accelerometer

Measure device motion along 3 axes

gyroscope

Measure device orientation and rate of rotation

magnetometer

Detect magnetic field changes (compass orientation)

Hardware y Red

payment

Invoke Payment Request API for web payments

usb

Communicate directly with USB peripherals

serial

Communicate with serial ports and microcontroller boards

bluetooth

Connect and exchange data with Bluetooth Low Energy devices

Pantalla y Navegación

fullscreen

Request fullscreen display of elements

picture-in-picture

Play floating video windows outside the tab

screen-wake-lock

Prevent device screen from dimming or locking

autoplay

Automatically start playback of audio or video elements

Cabecera y Fragmentos de Frameworks Generados

W3C Spec

Permissions-Policy: camera=(), microphone=(), speaker-selection=(), display-capture=(), geolocation=(), accelerometer=(), gyroscope=(), magnetometer=(), payment=(), usb=(), serial=(), bluetooth=(), fullscreen=(self), picture-in-picture=(), screen-wake-lock=(), autoplay=()

// In next.config.mjs headers or proxy.ts
{
  key: 'Permissions-Policy',
  value: 'camera=(), microphone=(), speaker-selection=(), display-capture=(), geolocation=(), accelerometer=(), gyroscope=(), magnetometer=(), payment=(), usb=(), serial=(), bluetooth=(), fullscreen=(self), picture-in-picture=(), screen-wake-lock=(), autoplay=()'
}

add_header Permissions-Policy "camera=(), microphone=(), speaker-selection=(), display-capture=(), geolocation=(), accelerometer=(), gyroscope=(), magnetometer=(), payment=(), usb=(), serial=(), bluetooth=(), fullscreen=(self), picture-in-picture=(), screen-wake-lock=(), autoplay=()" always;

<meta http-equiv="Permissions-Policy" content="camera=(), microphone=(), speaker-selection=(), display-capture=(), geolocation=(), accelerometer=(), gyroscope=(), magnetometer=(), payment=(), usb=(), serial=(), bluetooth=(), fullscreen=(self), picture-in-picture=(), screen-wake-lock=(), autoplay=()">

Estándar Moderno de Seguridad

Permissions-Policy sustituye al antiguo Feature-Policy. Despliega esta cabecera mediante proxy inverso, CDN o servidor para proteger la superficie de ataque.

Permissions-Policy: camera=(), microphone=(), speaker-selection=(), display-capture=(), geolocation=(), accelerometer=(), gyroscope=(), magnetometer=(), payment=(), usb=(), serial=(), bluetooth=(), fullscreen=(self), picture-in-picture=(), screen-wake-lock=(), autoplay=()

// In next.config.mjs headers or proxy.ts { key: 'Permissions-Policy', value: 'camera=(), microphone=(), speaker-selection=(), display-capture=(), geolocation=(), accelerometer=(), gyroscope=(), magnetometer=(), payment=(), usb=(), serial=(), bluetooth=(), fullscreen=(self), picture-in-picture=(), screen-wake-lock=(), autoplay=()' }

add_header Permissions-Policy "camera=(), microphone=(), speaker-selection=(), display-capture=(), geolocation=(), accelerometer=(), gyroscope=(), magnetometer=(), payment=(), usb=(), serial=(), bluetooth=(), fullscreen=(self), picture-in-picture=(), screen-wake-lock=(), autoplay=()" always;