django-permissions-policy
Set the draft security HTTP header Permissions-Policy (previously Feature-Policy) on your Django app.
Requirements
Python 3.6 to 3.10 supported.
Django 2.2 to 4.0 supported.
Are your tests slow? Check out my book Speed Up Your Django Tests which covers loads of best practices so you can write faster, more accurate tests.
Installation
- Install with pip:
python -m pip install django-permissions-policy
2. Add the middleware in your MIDDLEWARE setting. It’s best to add it after Django's SecurityMiddleware, so it adds the header at the same point in your stack:
MIDDLEWARE = [
...,
"django.middleware.security.SecurityMiddleware",
"django_permissions_policy.PermissionsPolicyMiddleware",
...,
]
Add the
PERMISSIONS_POLICYsetting to your settings, naming at least one feature. Here’s an example that sets a strict policy to disable many potentially privacy-invading and annoying features for all scripts:PERMISSIONS_POLICY = { "accelerometer": [], "ambient-light-sensor": [], "autoplay": [], "camera": [], "display-capture": [], "document-domain": [], "encrypted-media": [], "fullscreen": [], "geolocation": [], "gyroscope": [], "interest-cohort": [], "magnetometer": [], "microphone": [], "midi": [], "payment": [], "usb": [], }
See below for more information on the setting.
Setting
Change the PERMISSIONS_POLICY setting to configure the contents of the header.
The setting should be a dictionary laid out with:
Keys as the names of browser features - a full list is available on the W3 Spec repository. The MDN article is also worth reading.
Values as lists of strings, where each string is either an origin, e.g.
'https://example.com', or of the special values'self'or'*'. If there is just one value, no containing list is necessary. To represent no origins being allowed, use an empty list.Note that in the header, domains are wrapped in double quotes - do not include these quotes within your Python string, as they will be added by the middleware.
If the keys or values are invalid, ImproperlyConfigured will be raised at instantiation time, or when processing a response. The current feature list is pulled from the JavaScript API with document.featurePolicy.allowedFeatures() on Chrome.
For backwards compatibility with old configuration, the value 'none' is supported in lists, but ignored - it's preferable to use the empty list instead. It doesn't make sense to specify 'none' alongside other values.
Examples
Disable geolocation entirely, for the current origin and any iframes:
PERMISSIONS_POLICY = {
"geolocation": [],
}
Allow autoplay from only the current origin and iframes from https://archive.org:
PERMISSIONS_POLICY = {
"autoplay": ["self", "https://archive.org"],
}
Allow autoplay from all origins:
PERMISSIONS_POLICY = {
"autoplay": "*",
}
3.3k Jan 4, 2023
7 Nov 26, 2022
5 Jun 27, 2022
59 Dec 21, 2022
167 Nov 10, 2022
1 Dec 9, 2021
8 Jun 25, 2021
68 Oct 19, 2022
18 Sep 9, 2022
1 Oct 27, 2021
21 Dec 17, 2022
205 Dec 26, 2022
11 Nov 20, 2022
19 Oct 22, 2022
621 Dec 30, 2022
2 Sep 8, 2022
2.7k Jan 7, 2023
909 Dec 26, 2022
1.1k Dec 14, 2022