allow (Permissions Policy)

How it works

Permissions Policy controls which browser features a page and its frames can use. A site sets it in two ways. The Permissions-Policy header sets it for the whole page. The allow attribute sets it for one iframe.

The browser joins the two policies and uses the stricter result. A frame gets a feature only when both the parent policy and the allow attribute list its origin. When a parent blocks a feature, the frame and its own frames cannot turn it back on.

Allowlist values

Value	Meaning in allow
(none)	Same as 'src'. This is the default.
'src'	Allowed if the framed page has the origin of src.
'self'	Allowed for the origin of the parent page.
*	Allowed for any origin.
'none'	Blocked in the frame.
An origin	Allowed for that origin, for example https://widget.example.

Permissions Policy was called Feature Policy before. The header syntax changed with the name. The allow syntax stayed the same.

<iframe
  src="https://widget.example/call"
  allow="camera; microphone; fullscreen"
  title="Video call"
></iframe>

<iframe
  src="https://widget.example/map"
  allow="geolocation 'src'; fullscreen 'none'"
  title="Store map"
></iframe>