https://img.shields.io/github/actions/workflow/status/adamchainz/django-permissions-policy/main.yml.svg?branch=main&style=for-the-badge https://img.shields.io/badge/Coverage-100%25-success?style=for-the-badge https://img.shields.io/pypi/v/django-permissions-policy.svg?style=for-the-badge https://img.shields.io/badge/code%20style-black-000000.svg?style=for-the-badge pre-commit

Set the Permissions-Policy HTTP header on your Django app.

Work smarter and faster with my book Boost Your Django DX which covers many ways to improve your development experience.

Requirements

Python 3.9 to 3.13 supported.

Django 4.2 to 5.1 supported.

Installation

  1. Install with pip:

python -m pip install django-permissions-policy

2. Add the middleware in your MIDDLEWARE setting. It’s best to add it after Django’s SecurityMiddleware, so it adds the header at the same point in your stack:

MIDDLEWARE = [
    ...,
    "django.middleware.security.SecurityMiddleware",
    "django_permissions_policy.PermissionsPolicyMiddleware",
    ...,
]

  1. Add the PERMISSIONS_POLICY setting to your settings, naming at least one feature. Here’s an example that sets a strict policy to disable many potentially privacy-invading and annoying features for all scripts:

    PERMISSIONS_POLICY = {
    "accelerometer": [],
    "ambient-light-sensor": [],
    "autoplay": [],
    "camera": [],
    "display-capture": [],
    "encrypted-media": [],
    "fullscreen": [],
    "geolocation": [],
    "gyroscope": [],
    "interest-cohort": [],
    "magnetometer": [],
    "microphone": [],
    "midi": [],
    "payment": [],
    "usb": [],
}

    See below for more information on the setting.

Setting

Change the PERMISSIONS_POLICY setting to configure the contents of the header.

The setting should be a dictionary laid out with:

  • Keys as the names of browser features - a full list is available on the W3 Spec repository. The MDN article is also worth reading.

  • Values as lists of strings, where each string is either an origin, e.g. 'https://example.com', or of the special values 'self' or '*'. If there is just one value, no containing list is necessary. To represent no origins being allowed, use an empty list.

    Note that in the header, domains are wrapped in double quotes - do not include these quotes within your Python string, as they will be added by the middleware.

If the keys or values are invalid, ImproperlyConfigured will be raised at instantiation time, or when processing a response. The current feature list is pulled from the JavaScript API with document.featurePolicy.allowedFeatures() on Chrome and Firefox. Browsers don’t always recognize all features, depending on the version and configuration. You may see warnings in the console for unavailable features in the header - these are normally safe to ignore, since django-permissions-policy already validates that you don’t have completely unknown names.

For backwards compatibility with old configuration, the value 'none' is supported in lists, but ignored - it’s preferable to use the empty list instead. It doesn’t make sense to specify 'none' alongside other values.

Examples

Disable geolocation entirely, for the current origin and any iframes:

PERMISSIONS_POLICY = {
    "geolocation": [],
}

Allow autoplay from only the current origin and iframes from https://archive.org:

PERMISSIONS_POLICY = {
    "autoplay": ["self", "https://archive.org"],
}

Allow autoplay from all origins:

PERMISSIONS_POLICY = {
    "autoplay": "*",
}

Project links

Data verified by PyPI on Jan 7, 2025
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (4.32.0)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for AdamChainz from gravatar.com AdamChainz

Credits

Author: Adam Johnson

GitHub Statistics

Data verified by PyPI on Jan 7, 2025
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License

MIT License

Requires

Python >=3.9

Tags

Django

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

django_permissions_policy-4.24.0.tar.gz (10.0 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

django_permissions_policy-4.24.0-py3-none-any.whl (6.7 kB view details)

Uploaded Python 3

File details

Details for the file django_permissions_policy-4.24.0.tar.gz.

File metadata

File hashes

Hashes for django_permissions_policy-4.24.0.tar.gz
Algorithm Hash digest
SHA256 540388c7f7a19ec20d6d314ffdccb730ca164c177354c742cb0f51f27d3bae07
MD5 4072db4abd835d5abaf18a3d7d0e3b9b
BLAKE2b-256 b5b343da16a6e3caab7e86c2799d17d96fd9b54137187a49ed46a1e2623fd56b

See more details on using hashes here.

Provenance

The following attestation bundles were made for django_permissions_policy-4.24.0.tar.gz:

Publisher: main.yml on adamchainz/django-permissions-policy

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file django_permissions_policy-4.24.0-py3-none-any.whl.

File metadata

File hashes

Hashes for django_permissions_policy-4.24.0-py3-none-any.whl
Algorithm Hash digest
SHA256 0839eefb0d376a055f9f3336e4fd917fc8d2b110426ba6a387a07a8897c5b94d
MD5 ccc57926c840f934955b809c82db3fea
BLAKE2b-256 0afdc944f2a8a411b6444d02797daeaf3bc77ee15625da8a40c258cbaeb87ff4

See more details on using hashes here.

Provenance

The following attestation bundles were made for django_permissions_policy-4.24.0-py3-none-any.whl:

Publisher: main.yml on adamchainz/django-permissions-policy

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page