Permissions-Policy (Feature-Policy): Restricting browser hardware APIs (Camera, Mic, Geolocation).

Principle of Least Privilege in the Browser

Even if an attacker successfully injects a third-party script or executes a cross-site scripting attack, they should not be allowed to silently access hardware sensors or initiate browser payments. The Permissions-Policy HTTP header explicitly disables unused browser APIs.

Permissions-Policy: camera=(), 
                    microphone=(), 
                    geolocation=(), 
                    payment=(), 
                    usb=(), 
                    screen-wake-lock=()

How Permissions-Policy Protects Users

• camera=(): Completely blocks any script or embedded <iframe> from accessing the webcam.
• microphone=(): Disables audio recording.
• geolocation=(): Prevents malicious advertisements or third-party tracking scripts from harvesting the user’s exact GPS coordinates.
• Selective Delegation: If your application requires payment APIs only for a specific trusted payment provider:

Permissions-Policy: payment=(self "https://js.stripe.com")