From 86494cc034f459aeb96648944b1f195a05d232ff Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?L=C3=A9o=20Colombaro?= Date: Mon, 14 Jun 2021 14:45:08 +0200 Subject: [PATCH] Add `Permissions-Policy` header Closes https://github.com/h5bp/server-configs-apache/issues/179 --- h5bp/security/permissions-policy.conf | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 h5bp/security/permissions-policy.conf diff --git a/h5bp/security/permissions-policy.conf b/h5bp/security/permissions-policy.conf new file mode 100644 index 00000000..ea57799e --- /dev/null +++ b/h5bp/security/permissions-policy.conf @@ -0,0 +1,25 @@ +# ---------------------------------------------------------------------- +# | Permissions Policy | +# ---------------------------------------------------------------------- + +# Set a strict Permissions Policy to mitigate access to browser features. +# +# The header uses a structured syntax, and allows sites to more tightly +# restrict which origins can be granted access to features. +# The list of available features: https://github.com/w3c/webappsec-permissions-policy/blob/main/features.md +# +# The example policy below aims to disable all features expect synchronous +# `XMLHttpRequest` requests on the same origin. +# +# To check your Permissions Policy, you can use an online service, such as: +# https://securityheaders.com/ +# https://observatory.mozilla.org/ +# +# https://www.w3.org/TR/permissions-policy-1/ +# https://owasp.org/www-project-secure-headers/#permissions-policy +# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy +# https://scotthelme.co.uk/a-new-security-header-feature-policy/ + + + Header always set Permissions-Policy "accelerometer=(),autoplay=(),camera=(),display-capture=(),document-domain=(),encrypted-media=(),fullscreen=(),geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),picture-in-picture=(),publickey-credentials-get=(),screen-wake-lock=(),sync-xhr=(self),usb=(),web-share=(),xr-spatial-tracking=()" "expr=%{CONTENT_TYPE} =~ m#text\/(html|javascript)|application\/pdf|xml#i" +