permissions-policy

import express from 'express'; import permissionsPolicy from 'permissions-policy'; import { Request, Response, NextFunction } from 'express'; const app = express(); const port = 3000; // Apply the permissions-policy middleware early in your middleware chain. app.use( permissionsPolicy({ features: { fullscreen: ['self'], // Allows fullscreen requests from the current origin. vibrate: ['none'], // Disables the Vibration API entirely. payment: ['self', 'https://example.com'], // Allows Payment Request API from 'self' and 'example.com'. syncXhr: [], // Disables synchronous XMLHttpRequest. accelerometer: ['self'], // Allows accelerometer access from 'self'. camera: ['*'], // Allows camera access from any origin (use with caution). interestCohort: ['*'] // Allows FLoC/Interest Cohort API from any origin. }, // Custom or experimental directives can be added since v0.6.0 'my-experimental-feature': ['self', 'https://cdn.my-site.com'], }) ); app.get('/', (req: Request, res: Response) => { res.send('Hello! Check your response headers for Permissions-Policy.'); }); app.get('/test-policy', (req: Request, res: Response) => { res.status(200).send('This page has a Permissions-Policy header set.'); }); app.listen(port, () => { console.log(`Server listening at http://localhost:${port}`); console.log('Open http://localhost:3000 in your browser and inspect network headers.'); });