Permissions-Policy header

[unindented]

When scanning my site through https://securityheaders.com/ I got flagged because I was missing a Feature-Policy header: https://scotthelme.co.uk/a-new-security-header-feature-policy/

Would you be interested in adding it to the template? I can make a PR if that's the case.

---

• Paper: https://w3c.github.io/webappsec-permissions-policy/
• MDN: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy
• CanIUse: https://caniuse.com/permissions-policy

[LeoColomb]

Thanks for opening this issue!
Before opening a PR, let's review the status of this header.
Does this header follow a published standard?
What is its browser support?

[unindented]

Does this header follow a published standard?

https://w3c.github.io/webappsec-feature-policy/

What is its browser support?

Chrome and Safari atm: https://caniuse.com/#feat=feature-policy

[LeoColomb]

Thanks for these links! 👍
On MDN: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy

That said, some concerns:

• W3C paper is a draft, not a released recommendation (yet);
• The support is very low and often partial when implemented.

I would suggest to wait for a more solid standard/support before adding a template here.

[unindented]

Sounds good to me. Thanks for considering!

[Malvoz]

When it comes to choosing which features to include in an example policy this standardized features table should come in handy. :)

[LeoColomb]

FYI, Feature Policy is deprecated and replaced by Permissions Policy.
https://caniuse.com/permissions-policy