# Feature-Policy Is Being Renamed to Permissions-Policy

DevFeed: [Feature-Policy Is Being Renamed to Permissions-Policy](<https://devfeed.tech/articles/bye-bye-feature-policy-hello-permissions-policy-19094.md>)

Original publisher: [Read original article](<https://httptoolkit.com/blog/renaming-feature-policy-to-permissions-policy/>)

Author: HTTP Toolkit; Tim Perry

Published: 2020-05-27T13:30:00Z

Content type: article

Language: en

Sources: [HTTP Toolkit](<https://devfeed.tech/sources/http-toolkit.md>)

Topics: [web-standards](<https://devfeed.tech/topics/web-standards.md>), [Security](<https://devfeed.tech/topics/security.md>), [HTTP](<https://devfeed.tech/topics/http.md>), [browser](<https://devfeed.tech/topics/browser.md>), [Node.js](<https://devfeed.tech/topics/node-js.md>), [Rails](<https://devfeed.tech/topics/rails.md>)

Tags: [browser](<https://devfeed.tech/tags/browser.md>), [browsers](<https://devfeed.tech/tags/browsers.md>), [http](<https://devfeed.tech/tags/http.md>), [node-js](<https://devfeed.tech/tags/node-js.md>), [rails](<https://devfeed.tech/tags/rails.md>), [security](<https://devfeed.tech/tags/security.md>), [standard](<https://devfeed.tech/tags/standard.md>), [standards](<https://devfeed.tech/tags/standards.md>)

## AI overview

The draft Feature-Policy web security standard, which controls browser features available to pages and embedded iframes, is being renamed to Permissions-Policy. The change also separates some proposed features into Document-Policy and may alter header value syntax.

## Source excerpt

Ever heard of Feature-Policy? It's a draft W3C web security standard, defining an HTTP header and iframe attribute that sets limits on the browser features a page can use. It's useful for any site that's concerned about XSS attacks, embedded content, security risks in dependencies, or major bugs in their own software, by setting guardrails on the browser features a page can use. You can use feature policy to guarantee your page or an embedded iframe cannot access the user's microphone or camera, can't read their location or phone sensors, can't use the Payment Request API, and so on. This is an extra safeguard, in addition to the browser's own permissions system, so it only tightens existing permission restrictions further. Feature Policy has been around a couple of years now, and got some good early press as a recommended security technique all over, from Google's web developer guide to Smashing Magazine. Since then browser support has made steady progress, with about 75% of users globally now supporting it (that's all recent browser versions except Safari). More recently that's lead to the start of real production usage: Rails 6.1 and Node.js's popular helmet security package recently shipped built-in support, and Scott Helme's latest analysis of the top 1 million sites shows the Feature-Policy header in use by nearly 5,000 of them. It is still just a draft though. That means it's subject to change, and it is now changing: the Feature-Policy standard & header is being renamed to Permissions-Policy. There's some discussion of the reasoning in the spec repo. In short: Many proposed additions don't mesh with the existing Feature-Policy behaviour, so these (along with some of the existing features) are being defined instead in a new Document-Policy header, with different semantics focused on feature configuration, rather than security. The remaining features are a strict subset of the separately defined set of web permissions. Renaming offers an opportunity to change