Augment deprecated "Feature-Policy" HTTP header with draft "Permissio…

…ns-Policy" (helmetjs/helmet#234).
DavidAnson · Dec 18, 2023 · d068202 · d068202
1 parent 4d4b1db
commit d068202
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 1 deletion.
diff --git a/app.js b/app.js
@@ -67,6 +67,7 @@ app.use(helmet({
   },
   "xFrameOptions": false
 }));
+// Deprecated, including by helmet
 app.use(featurePolicy({
   "features": {
     // Disable features with security/privacy implications
@@ -75,6 +76,11 @@ app.use(featurePolicy({
     "usb": ["'none'"]
   }
 }));
+// Draft specification, not yet supported by helmet
+app.use((req, res, next) => {
+  res.setHeader("Permissions-Policy", "geolocation=(), payment=(), usb=()");
+  next();
+});
 app.use(compression({
   "level": 9,
   "threshold": 0

diff --git a/sites/test/static/tests.js b/sites/test/static/tests.js
@@ -162,7 +162,7 @@ QUnit.test("Content-Type is correct and includes charset where applicable", (ass
 });
 
 QUnit.test("Get of / returns expected HTTP headers", (assert) => {
-  assert.expect(29);
+  assert.expect(31);
   const done = assert.async();
   fetch("/").
     then((response) => {
@@ -206,6 +206,12 @@ QUnit.test("Get of / returns expected HTTP headers", (assert) => {
             "payment 'none';" +
             "usb 'none'"
         ],
+        [
+          "Permissions-Policy",
+          "geolocation=(), " +
+            "payment=(), " +
+            "usb=()"
+        ],
         [
           "Referrer-Policy",
           "no-referrer-when-downgrade"