SEC-009
Permissions-Policy uses an ignored syntax
LowDefault severity · Security · Secrets, HTTPS and security headers
Last reviewed
What it checks
A Permissions-Policy header written in the old Feature-Policy syntax, which browsers fail to parse. A missing policy, or a Feature-Policy header on its own (still honoured by Chromium), is not reported.
Why it matters
Browsers ignore the old syntax, so the restrictions you think are in place (camera, microphone, location) are not applied.
Recommended fix
Send a Permissions-Policy that disables features the app does not use.
How to verify
Confirm the header is present and the app features that need permissions still work.
Example fix prompt
Generic prompt (your report adds the evidence)
Please fix this production issue in my app.
Issue SEC-009: Permissions-Policy uses an ignored syntax
Site: https://your-app.example
First confirm the issue in the code or live config. If it is not present, say so and change nothing.
Task: Add a `Permissions-Policy` response header that disables unused browser features, for example `camera=(), microphone=(), geolocation=(), payment=()`; keep any feature the app genuinely uses.
Constraints: make the smallest change that fixes this, keep the current design and behaviour, never paste secret values into code or chat, and tell me which files you changed.
Done when: Confirm the header is present and the app features that need permissions still work.