recursal/MDN huggingface dataset:
CSP: manifest-src
=================

 The HTTP
 `Content-Security-Policy``: manifest-src`
 directive specifies which manifest can be applied
 to the resource.


|  |  |
| --- | --- |
| CSP version | 3 |
| Directive type | Fetch directive |
| `default-src` fallback | 
 Yes. If this directive is absent, the user agent will look for the
 `default-src` directive.
  |

Syntax
------

One or more sources can be allowed for the `manifest-src` policy:


```http
Content-Security-Policy: manifest-src <source>;
Content-Security-Policy: manifest-src <source> <source>;
```

### Sources

`<source>` can be any one of the values listed in CSP Source Values.

Note that this same set of values can be used in all fetch directives (and a number of other directives).

Examples
--------

### Violation cases

Given this CSP header:


```http
Content-Security-Policy: manifest-src https://example.com/
```


The following `<link>` is blocked and won't load:


```html
<link rel="manifest" href="https://not-example.com/manifest" />
```

Specifications
--------------

| Specification |
| --- |
| Content Security Policy Level 3 # directive-manifest-src |

Browser compatibility
---------------------

BCD tables only load in the browser with JavaScript enabled. Enable JavaScript to view data.

See also
--------

* `Content-Security-Policy`
* Web app manifest
* `<link>`
Permissions-Policy: microphone
==============================

The HTTP `Permissions-Policy` header `microphone` directive controls whether the current document is allowed to use audio input devices.

 Specifically, where a defined policy blocks use of this feature, `MediaDevices.getUserMedia()` calls will return a `Promise`
 that rejects with a `NotAllowedError` `DOMException`.

Syntax
------


```http
Permissions-Policy: microphone=<allowlist>;
```


`<allowlist>`

A list of origins for which permission is granted to use the feature. See `Permissions-Policy` > Syntax for more details.

Default policy
--------------

The default allowlist for `microphone` is `self`.

Specifications
--------------

| Specification |
| --- |
| Media Capture and Streams # permissions-policy-integration |

Browser compatibility
---------------------

BCD tables only load in the browser with JavaScript enabled. Enable JavaScript to view data.

See also
--------

* `Permissions-Policy` header
* Permissions Policy
Permissions-Policy: display-capture
===================================

The HTTP `Permissions-Policy` header `display-capture` directive controls whether or not the document is permitted to use Screen Capture API, that is, `getDisplayMedia()` to capture the screen's contents.

If `display-capture` is disabled in a document, the document will not be able to initiate screen capture via `getDisplayMedia()` and will throw a `NotAllowedError` exception.

Syntax
------


```http
Permissions-Policy: display-capture=<allowlist>;
```


`<allowlist>`

A list of origins for which permission is granted to use the feature. See `Permissions-Policy` > Syntax for more details.

Default policy
--------------

The default allowlist for `display-capture` is `self`.

Specifications
--------------

| Specification |
| --- |
| Screen Capture # permissions-policy-integration |

Browser compatibility
---------------------

BCD tables only load in the browser with JavaScript enabled. Enable JavaScript to view data.

See also
--------

* `Permissions-Policy` header
* Permissions Policy
* Screen Capture API
* Using the Screen Capture API
Permissions-Policy: autoplay
============================

**Experimental:** **This is an experimental technology**  
Check the Browser compatibility table carefully before using this in production.

 The HTTP `Permissions-Policy` header
 `autoplay` directive controls whether the current document is allowed to
 autoplay media requested through the `HTMLMediaElement` interface.

 Specifically, where a defined policy blocks use of this feature and there were no user gestures, the `Promise`
 returned by `HTMLMediaElement.play()` will reject with
 a `DOMException`. The `autoplay` attribute on
 `<audio>` and `<video>` elements will be ignored.

**Note:** For more details on autoplay and autoplay blocking, see the article Autoplay guide for media and Web Audio APIs.

Syntax
------


```http
Permissions-Policy: autoplay=<allowlist>;
```


`<allowlist>`

A list of origins for which permission is granted to use the feature. See `Permissions-Policy` > Syntax for more details.

Default policy
--------------

The default allowlist for `autoplay` is `self`.

Specifications
--------------

| Specification |
| --- |
| HTML Standard # autoplay-feature |

Browser compatibility
---------------------

BCD tables only load in the browser with JavaScript enabled. Enable JavaScript to view data.

See also
--------

* `Permissions-Policy` header
* Permissions Policy
Permissions-Policy: ambient-light-sensor
========================================

**Experimental:** **This is an experimental technology**  
Check the Browser compatibility table carefully before using this in production.

The HTTP `Permissions-Policy` header `ambient-light-sensor` directive controls whether the current document is allowed to gather information about the amount of light in the environment around the device through the `AmbientLightSensor` interface.

Specifically, where a defined policy blocks use of this feature, `AmbientLightSensor()` constructor calls will throw a `DOMException` of type `SecurityError`.

Syntax
------


```http
Permissions-Policy: ambient-light-sensor=<allowlist>;
```


`<allowlist>`

A list of origins for which permission is granted to use the feature. See `Permissions-Policy` > Syntax for more details.

Default policy
--------------

The default allowlist for `ambient-light-sensor` is `self`.

Specifications
--------------

| Specification |
| --- |
| Generic Sensor API # permissions-policy |

Browser compatibility
---------------------

BCD tables only load in the browser with JavaScript enabled. Enable JavaScript to view data.

See also
--------

* `Permissions-Policy` header
* Permissions Policy
Permissions-Policy: publickey-credentials-get
=============================================

The HTTP `Permissions-Policy` header `publickey-credentials-get` directive controls whether the current document is allowed to access the Web Authentication API to retrieve public-key credentials, i.e., via `navigator.credentials.get({publicKey})`.

Specifically, where a defined policy blocks the use of this feature, the `Promise` returned by `navigator.credentials.get({publicKey})` will reject with a `SecurityError` `DOMException`.

Syntax
------


```http
Permissions-Policy: publickey-credentials-get=<allowlist>;
```


`<allowlist>`

A list of origins for which permission is granted to use the feature. See `Permissions-Policy` > Syntax for more details.

Default policy
--------------

The default allowlist for `publickey-credentials-get` is `self`.

Specifications
--------------

| Specification |
| --- |
| Web Authentication: An API for accessing Public Key Credentials - Level 3 # sctn-permissions-policy |

Browser compatibility
---------------------

BCD tables only load in the browser with JavaScript enabled. Enable JavaScript to view data.

See also
--------

* `Permissions-Policy` header
* Permissions Policy
* Web Authentication API
* `PublicKeyCredential` interface
Permissions-Policy: window-management
=====================================

**Experimental:** **This is an experimental technology**  
Check the Browser compatibility table carefully before using this in production.

The HTTP `Permissions-Policy` header `window-management` directive controls whether or not the current document is allowed to use the Window Management API to manage windows on multiple displays.

Where this policy forbids use of the API:

* The `Promise` returned by the `Window.getScreenDetails()` method will reject with a `NotAllowedError` exception.
* The `Window.screen.isExtended` property will always return `false`.
Syntax
------


```http
Permissions-Policy: window-management=<allowlist>;
```


`<allowlist>`

A list of origins for which permission is granted to use the feature. See `Permissions-Policy` > Syntax for more details.

Default policy
--------------

The default allowlist for `window-management` is `self`.

Specifications
--------------

| Specification |
| --- |
| Window Management # api-permission-policy-integration |

Browser compatibility
---------------------

BCD tables only load in the browser with JavaScript enabled. Enable JavaScript to view data.

See also
--------

* Window Management API
* `Permissions-Policy` header
* Permissions Policy
Permissions-Policy: local-fonts
===============================

**Experimental:** **This is an experimental technology**  
Check the Browser compatibility table carefully before using this in production.

The HTTP `Permissions-Policy` header `local-fonts` directive controls whether the current document is allowed to gather data on the user's locally-installed fonts via the `Window.queryLocalFonts()` method.

Specifically, where a defined policy blocks use of this feature, `Promise`s returned by `Window.queryLocalFonts()` will reject with a `DOMException` of type `SecurityError`.

Syntax
------


```http
Permissions-Policy: local-fonts=<allowlist>;
```


`<allowlist>`

A list of origins for which permission is granted to use the feature. See `Permissions-Policy` > Syntax for more details.

Default policy
--------------

The default allowlist for `local-fonts` is `self`.

Specifications
--------------

| Specification |
| --- |
| Local Font Access # permissions-policy |

Browser compatibility
---------------------

BCD tables only load in the browser with JavaScript enabled. Enable JavaScript to view data.

See also
--------

* Local Font Access API
* `Permissions-Policy` header
* Permissions Policy
Permissions-Policy: execution-while-out-of-viewport
===================================================

**Experimental:** **This is an experimental technology**  
Check the Browser compatibility table carefully before using this in production.

The HTTP `Permissions-Policy` header `execution-while-out-of-viewport` directive controls whether tasks should execute in frames while they're outside of the visible viewport.

Specifically, where a defined policy blocks execution of task rendering while content is not in the visible viewport, while that condition is true, the content will be put in the frozen state as defined in the Page Lifecycle API. This stops execution of freezable tasks such as JavaScript timers (e.g. `setTimeout()`) and `fetch()` callbacks.

Syntax
------


```http
Permissions-Policy: execution-while-out-of-viewport=<allowlist>;
```


`<allowlist>`

A list of origins for which permission is granted to use the feature. See `Permissions-Policy` > Syntax for more details.

Default policy
--------------

The default allowlist for `execution-while-out-of-viewport` is `*`.

Specifications
--------------

| Specification |
| --- |
| Page Lifecycle # feature-policies |

Browser compatibility
---------------------

BCD tables only load in the browser with JavaScript enabled. Enable JavaScript to view data.

See also
--------

* `Permissions-Policy` header
* Permissions Policy
Permissions-Policy: geolocation
===============================

 The HTTP `Permissions-Policy` header
 `geolocation` directive controls whether the current document is allowed to
 use the `Geolocation` Interface.

 Specifically, where a defined policy blocks use of this feature, calls to
 `getCurrentPosition()` and
 `watchPosition()` will cause those functions'
 callbacks to be invoked with a `GeolocationPositionError` code of
 `PERMISSION_DENIED`.

 By default, the Geolocation API can be used within top-level documents and their
 same-origin child frames. This directive allows or prevents cross-origin frames from
 accessing geolocation. This includes same-origin frames.

Syntax
------


```http
Permissions-Policy: geolocation=<allowlist>;
```


`<allowlist>`

A list of origins for which permission is granted to use the feature. See `Permissions-Policy` > Syntax for more details.

Default policy
--------------

The default allowlist for `geolocation` is `self`.

Examples
--------

### General example

 SecureCorp Inc. wants to disable the Geolocation API within all browsing contexts
 except for its own origin and those whose origin is `https://example.com`. It
 can do so by delivering the following HTTP response header to define a Permissions Policy:


```http
Permissions-Policy: geolocation=(self "https://example.com")
```

### With an <iframe> element

 FastCorp Inc. wants to disable `geolocation` for all cross-origin child
 frames, except for a specific `<iframe>`. It can do so by delivering the following
 HTTP response header to define a Permissions Policy:


```http
Permissions-Policy: geolocation=(self)
```


 Then include an allow attribute on the
 `<iframe>` element:


```html
<iframe src="https://other.com/map" allow="geolocation"></iframe>
```


 Interestingly, `allow` attributes can selectively enable features in certain frames, and not in others,
 even if those frames contain documents from the same origin.

Specifications
--------------

| Specification |
| --- |
| Geolocation API # permissions-policy |

Browser compatibility
---------------------

BCD tables only load in the browser with JavaScript enabled. Enable JavaScript to view data.

See also
--------

* `Permissions-Policy` header
* Permissions Policy
Permissions-Policy: battery
===========================

**Experimental:** **This is an experimental technology**  
Check the Browser compatibility table carefully before using this in production.

The HTTP `Permissions-Policy` header `battery` directive controls whether the current document is allowed to gather information about the battery of the device through the `BatteryManager` interface obtained via `Navigator.getBattery()`.

Specifically, where a defined policy blocks use of this feature, `getBattery()` calls will return a `Promise` that rejects with a `DOMException` of type `NotAllowedError`.

Syntax
------


```http
Permissions-Policy: battery=<allowlist>;
```


`<allowlist>`

A list of origins for which permission is granted to use the feature. See `Permissions-Policy` > Syntax for more details.

Default policy
--------------

The default allowlist for `battery` is `self`.

Specifications
--------------

| Specification |
| --- |
| Battery Status API # permissions-policy-integration |

Browser compatibility
---------------------

BCD tables only load in the browser with JavaScript enabled. Enable JavaScript to view data.

See also
--------

* `Permissions-Policy` header
* Permissions Policy
* Battery Status API
* `Navigator.getBattery()`
* `BatteryManager`
Permissions-Policy: idle-detection
==================================

Limited availability
--------------------

This feature is not Baseline because it does not work in some of the most widely-used browsers.

* Learn more
* See full compatibility
* Report feedback
**Experimental:** **This is an experimental technology**  
Check the Browser compatibility table carefully before using this in production.

The HTTP `Permissions-Policy` header `idle-detection` directive controls whether the current document is allowed to use the Idle Detection API to detect when users are interacting with their devices, for example to report "available"/"away" status in chat applications.

Specifically, where a defined policy blocks use of this feature, `IdleDetector.start()` calls will return a `Promise` that rejects with a `DOMException` of type `NotAllowedError`.

Syntax
------


```http
Permissions-Policy: idle-detection=<allowlist>;
```


`<allowlist>`

A list of origins for which permission is granted to use the feature. See `Permissions-Policy` > Syntax for more details.

Default policy
--------------

The default allowlist for `idle-detection` is `self`.

Specifications
--------------

| Specification |
| --- |
| Idle Detection API # api-permissions-policy |

Browser compatibility
---------------------

BCD tables only load in the browser with JavaScript enabled. Enable JavaScript to view data.

See also
--------

* `Permissions-Policy` header
* Permissions Policy
Permissions-Policy: magnetometer
================================

**Experimental:** **This is an experimental technology**  
Check the Browser compatibility table carefully before using this in production.

The HTTP `Permissions-Policy` header `magnetometer` directive controls whether the current document is allowed to gather information about the orientation of the device through the `Magnetometer` interface.

Specifically, where a defined policy blocks use of this feature, `Magnetometer()` constructor calls will throw a `DOMException` of type `SecurityError`.

Syntax
------


```http
Permissions-Policy: magnetometer=<allowlist>;
```


`<allowlist>`

A list of origins for which permission is granted to use the feature. See `Permissions-Policy` > Syntax for more details.

Default policy
--------------

The default allowlist for `magnetometer` is `self`.

Specifications
--------------

| Specification |
| --- |
| Generic Sensor API # permissions-policy |

Browser compatibility
---------------------

BCD tables only load in the browser with JavaScript enabled. Enable JavaScript to view data.

See also
--------

* `Permissions-Policy` header
* Permissions Policy
Permissions-Policy: camera
==========================

 The HTTP `Permissions-Policy` header
 `camera` directive controls whether the current document is allowed to use
 video input devices.

Specifically, where a defined policy blocks use of this feature, `MediaDevices.getUserMedia()` calls will return a `Promise` that rejects with a `NotAllowedError` `DOMException`.

Syntax
------


```http
Permissions-Policy: camera=<allowlist>;
```


`<allowlist>`

A list of origins for which permission is granted to use the feature. See `Permissions-Policy` > Syntax for more details.

Default policy
--------------

The default allowlist for `camera` is `self`.

Specifications
--------------

| Specification |
| --- |
| Media Capture and Streams # permissions-policy-integration |

Browser compatibility
---------------------

BCD tables only load in the browser with JavaScript enabled. Enable JavaScript to view data.

See also
--------

* `Permissions-Policy` header
* Permissions Policy
Permissions-Policy: web-share
=============================

The HTTP `Permissions-Policy` header `web-share` directive controls whether the current document is allowed to use the `Navigator.share()` method of the Web Share API to share text, links, images, and other content to arbitrary destinations of the user's choice.

Specifically, where a defined policy blocks usage of this feature, `Navigator.share()` calls will return a `Promise` that rejects with a `DOMException` of type `NotAllowedError`.

Syntax
------


```http
Permissions-Policy: web-share=<allowlist>;
```


`<allowlist>`

A list of origins for which permission is granted to use the feature. See `Permissions-Policy` > Syntax for more details.

Default policy
--------------

The default allowlist for `web-share` is `self`.

Specifications
--------------

| Specification |
| --- |
| Web Share API # permissions-policy |

Browser compatibility
---------------------

BCD tables only load in the browser with JavaScript enabled. Enable JavaScript to view data.

See also
--------

* `Permissions-Policy` header
* Permissions Policy
Permissions-Policy: identity-credentials-get
============================================

**Experimental:** **This is an experimental technology**  
Check the Browser compatibility table carefully before using this in production.

The HTTP `Permissions-Policy` header `identity-credentials-get` directive controls whether the current document is allowed to use the Federated Credential Management API (FedCM), and more specifically the `navigator.credentials.get()` method with an `identity` option.

Where this policy forbids use of the API, the `Promise` returned by the `get()` call will reject with a `NotAllowedError` `DOMException`.

Syntax
------


```http
Permissions-Policy: identity-credentials-get=<allowlist>;
```


`<allowlist>`

A list of origins for which permission is granted to use the feature. See `Permissions-Policy` > Syntax for more details.

Default policy
--------------

The default allowlist for `identity-credentials-get` is `self`.

Specifications
--------------

| Specification |
| --- |
| Federated Credential Management API # permissions-policy-integration |

Browser compatibility
---------------------

BCD tables only load in the browser with JavaScript enabled. Enable JavaScript to view data.

See also
--------

* Federated Credential Management API (FedCM)
* `Permissions-Policy` header
* Permissions Policy
Permissions-Policy: publickey-credentials-create
================================================

**Experimental:** **This is an experimental technology**  
Check the Browser compatibility table carefully before using this in production.

The HTTP `Permissions-Policy` header `publickey-credentials-create` directive controls whether the current document is allowed to use the Web Authentication API to create new WebAuthn credentials, i.e., via `navigator.credentials.create({publicKey})`.

Specifically, where a defined policy blocks use of this feature, the `Promise` returned by `navigator.credentials.create({publicKey})` will reject with a `SecurityError` `DOMException`.

Syntax
------


```http
Permissions-Policy: publickey-credentials-create=<allowlist>;
```


`<allowlist>`

A list of origins for which permission is granted to use the feature. See `Permissions-Policy` > Syntax for more details.

Default policy
--------------

The default allowlist for `publickey-credentials-create` is `self`.

Specifications
--------------

| Specification |
| --- |
| Web Authentication: An API for accessing Public Key Credentials - Level 3 # sctn-permissions-policy |

Browser compatibility
---------------------

BCD tables only load in the browser with JavaScript enabled. Enable JavaScript to view data.

See also
--------

* `Permissions-Policy` header
* Permissions Policy
* Web Authentication API
* `PublicKeyCredential` interface
Permissions-Policy: screen-wake-lock
====================================

**Experimental:** **This is an experimental technology**  
Check the Browser compatibility table carefully before using this in production.

The HTTP `Permissions-Policy` header **`screen-wake-lock`** directive controls whether the current document is allowed to use Screen Wake Lock API to indicate that the device should not dim or turn off the screen.

Specifically, where a defined policy blocks use of this feature, `WakeLock.request()` calls will return a `Promise` that rejects with a `DOMException` of type `NotAllowedError`.

Syntax
------


```http
Permissions-Policy: screen-wake-lock=<allowlist>;
```


`<allowlist>`

A list of origins for which permission is granted to use the feature. See `Permissions-Policy` > Syntax for more details.

Default policy
--------------

The default allowlist for `screen-wake-lock` is `self`.

Specifications
--------------

| Specification |
| --- |
| Screen Wake Lock API # policy-control |

Browser compatibility
---------------------

BCD tables only load in the browser with JavaScript enabled. Enable JavaScript to view data.

See also
--------

* Screen Wake Lock API
* `Permissions-Policy` header
* Permissions Policy