Permissions policyLimited availability
The Permissions-Policy response header and the allow attribute for <iframe> elements sets whether a policy-controlled feature, such as an API, may be used in a document.
Not yet supported in all major browsers — check the table and provide a fallback.
Browser support
DesktopChrome
1–107Not supported
108+Supportedsince Nov 29, 2022
Current: 155Edge
12–107Not supported
108+Supportedsince Dec 5, 2022
Current: 154Firefox
✕Not supportedup to 157
Current: 157Safari
✕Not supportedup to 27
Current: 27MobileChrome Android
18–107Not supported
108+Supportedsince Nov 29, 2022
Current: 155Firefox Android
✕Not supportedup to 157
Current: 157Safari iOS
✕Not supportedup to 27
Current: 27How to use
Not supported in Firefox, Safari, Firefox Android, Safari iOS. Use feature detection below and provide a fallback (or a polyfill) for those browsers.
Example
Full syntax and examples are on MDN: allow.
Feature detection
JS · check before using
if ("HTMLIFrameElement" in globalThis && "allow" in HTMLIFrameElement.prototype) {
// HTMLIFrameElement.allow is available
}Documentation (MDN)
Specification
Usage share
Sub-features
Support for each part of the feature (4). The overall table above shows when the whole feature works.
| Sub-feature | Chrome | Edge | Firefox | Safari | Chrome Android | Firefox Android | Safari iOS |
|---|---|---|---|---|---|---|---|
| HTMLIFrameElement.allow | 60 | 79 | 74 | 11.1 | 60 | 79 | 11.3 |
| iframe.allow | 60 | 79 | 74 | 11.1 | 60 | 79 | 11.3 |
| http.headers.Permissions-Policy | 85 | 85 | ✕ | ✕ | 85 | ✕ | ✕ |
| http.headers.Permissions-Policy.wildcards | 108 | 108 | ✕ | ✕ | 108 | ✕ | ✕ |