django-permissions-policy

https://img.shields.io/badge/Coverage-100%25-success?style=for-the-badge

https://img.shields.io/pypi/v/django-permissions-policy.svg?style=for-the-badge

https://img.shields.io/badge/code%20style-black-000000.svg?style=for-the-badge

Set the draft security HTTP header Permissions-Policy (previously Feature-Policy) on your Django app.

Requirements

Python 3.8 to 3.12 supported.

Django 3.2 to 4.2 supported.

Want to work smarter and faster? Check out my book Boost Your Django DX which covers many ways to improve your development experience.

Installation

Install with pip:

python -m pip install django-permissions-policy

2. Add the middleware in your MIDDLEWARE setting. It’s best to add it after Django’s SecurityMiddleware, so it adds the header at the same point in your stack:

MIDDLEWARE = [
    ...,
    "django.middleware.security.SecurityMiddleware",
    "django_permissions_policy.PermissionsPolicyMiddleware",
    ...,
]

Add the PERMISSIONS_POLICY setting to your settings, naming at least one feature. Here’s an example that sets a strict policy to disable many potentially privacy-invading and annoying features for all scripts:

PERMISSIONS_POLICY = {
    "accelerometer": [],
    "ambient-light-sensor": [],
    "autoplay": [],
    "camera": [],
    "display-capture": [],
    "document-domain": [],
    "encrypted-media": [],
    "fullscreen": [],
    "geolocation": [],
    "gyroscope": [],
    "interest-cohort": [],
    "magnetometer": [],
    "microphone": [],
    "midi": [],
    "payment": [],
    "usb": [],
}

See below for more information on the setting.

Setting

Change the PERMISSIONS_POLICY setting to configure the contents of the header.

The setting should be a dictionary laid out with:

Keys as the names of browser features - a full list is available on the W3 Spec repository. The MDN article is also worth reading.
Values as lists of strings, where each string is either an origin, e.g. 'https://example.com', or of the special values 'self' or '*'. If there is just one value, no containing list is necessary. To represent no origins being allowed, use an empty list.

Note that in the header, domains are wrapped in double quotes - do not include these quotes within your Python string, as they will be added by the middleware.

If the keys or values are invalid, ImproperlyConfigured will be raised at instantiation time, or when processing a response. The current feature list is pulled from the JavaScript API with document.featurePolicy.allowedFeatures() on Chrome and Firefox. Browsers don’t always recognize all features, depending on the version and configuration. You may see warnings in the console for unavailable features in the header - these are normally safe to ignore, since django-permissions-policy already validates that you don’t have completely unknown names.

For backwards compatibility with old configuration, the value 'none' is supported in lists, but ignored - it’s preferable to use the empty list instead. It doesn’t make sense to specify 'none' alongside other values.

Examples

Disable geolocation entirely, for the current origin and any iframes:

PERMISSIONS_POLICY = {
    "geolocation": [],
}

Allow autoplay from only the current origin and iframes from https://archive.org:

PERMISSIONS_POLICY = {
    "autoplay": ["self", "https://archive.org"],
}

Allow autoplay from all origins:

PERMISSIONS_POLICY = {
    "autoplay": "*",
}

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

django_permissions_policy-4.17.0.tar.gz (9.8 kB view details)

Uploaded Jul 10, 2023 Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

The dropdown lists show the available interpreters, ABIs, and platforms. Enable javascript to be able to filter the list of wheel files.

django_permissions_policy-4.17.0-py3-none-any.whl (6.7 kB view details)

Uploaded Jul 10, 2023 Python 3

File details

Details for the file django_permissions_policy-4.17.0.tar.gz.

File metadata

Download URL: django_permissions_policy-4.17.0.tar.gz
Upload date: Jul 10, 2023
Size: 9.8 kB
Tags: Source
Uploaded using Trusted Publishing? No
Uploaded via: twine/4.0.2 CPython/3.11.4

File hashes

Hashes for django_permissions_policy-4.17.0.tar.gz
Algorithm	Hash digest
SHA256	`cb2f0d2772ddab63dabd50331fa823d0cea06c89932d412c8c6aa5fc239b364f`
MD5	`88be49009900827fa9a117b507877dd2`
BLAKE2b-256	`985f2fcbc5b5912e320352217ae416aa74b71dcb2c8103712a699e72ea51322f`

See more details on using hashes here.

File details

Details for the file django_permissions_policy-4.17.0-py3-none-any.whl.

File metadata

Download URL: django_permissions_policy-4.17.0-py3-none-any.whl
Upload date: Jul 10, 2023
Size: 6.7 kB
Tags: Python 3
Uploaded using Trusted Publishing? No
Uploaded via: twine/4.0.2 CPython/3.11.4

File hashes

Hashes for django_permissions_policy-4.17.0-py3-none-any.whl
Algorithm	Hash digest
SHA256	`e317143f8c8ef7ff30dc20bc1343f8f299c9e4423148957d9f0fc2bae04b0ebe`
MD5	`c2a63d9082d56afe4ef93bdd66a02654`
BLAKE2b-256	`fc22230c5740f1d296ed60235bc7eb1c41f7cd11db593f59f49c8d371bc8292d`