Permissions policy permissive

security.headers.permissions_policy_permissive

Outcome class: Automatic. An automated check that can report a confirmed violation.
Area: Security, response headers

What the rule checks

Scope. Applies to responses that carry a Permissions-Policy header.

Expectation. Fails when the header is present but restricts nothing: an empty value, or every listed feature allowed for all origins (`*`). A policy that disables or limits at least one feature passes. Without the header the check does not apply (that is permissions-policy missing_header).

Source. Permissions Policy (W3C), 'The Permissions-Policy HTTP header field' (structured-field dictionary of allowlists; `*` allows every origin)

Detection: analyze_security; needs network.

Failing example

The check reports a violation here. Corpus case permissions_policy_permissive. The case is a set of response headers; there is no page.

Response headersHTTP

Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Permissions-Policy: 
Referrer-Policy: strict-origin-when-cross-origin
X-Content-Type-Options: nosniff
X-Frame-Options: DENY

Passing example

The check passes here and reports nothing. Corpus case security_https_complete. The case is a set of response headers; there is no page.

Response headersHTTP

Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Permissions-Policy: geolocation=(), camera=()
Referrer-Policy: strict-origin-when-cross-origin
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
X-Content-Type-Options: nosniff
X-Frame-Options: DENY

This page is generated from the rule catalogue and the rule contracts; see therule overview for how the outcome classes are derived.