django-permissions-policy
Set the Permissions-Policy HTTP header on your Django app.
Work smarter and faster with my book Boost Your Django DX which covers many ways to improve your development experience.
Requirements
Python 3.10 to 3.15 supported.
Django 5.2 to 6.1 supported.
Installation
Install with pip:
python -m pip install django-permissions-policy2. Add the middleware in your MIDDLEWARE setting. It’s best to add it after Django’s SecurityMiddleware, so it adds the header at the same point in your stack:
MIDDLEWARE = [
...,
"django.middleware.security.SecurityMiddleware",
"django_permissions_policy.PermissionsPolicyMiddleware",
...,
]Add a PERMISSIONS_POLICY or PERMISSIONS_POLICY_REPORT_ONLY setting to your settings file, naming at least one feature. Here’s an example that sets a strict policy to disable many potentially privacy-invading and annoying features for all scripts:
PERMISSIONS_POLICY = { "accelerometer": [], "ambient-light-sensor": [], "autoplay": [], "camera": [], "display-capture": [], "encrypted-media": [], "fullscreen": [], "geolocation": [], "gyroscope": [], "interest-cohort": [], "magnetometer": [], "microphone": [], "midi": [], "payment": [], "usb": [], }See below for more information on the settings.
Settings
The permissions policy for your page is configured with two settings:
PERMISSIONS_POLICY - sets the Permissions-Policy header, which defines the policy that the browser enforces.
PERMISSIONS_POLICY_REPORT_ONLY - sets the Permissions-Policy-Report-Only header, which defines a policy that the browser simulates but does not enforce.
In both cases, any violations are reported to the console and optionally to a reporting endpoint defined by the Reporting-Endpoints header. The report-only header is useful for testing a new policy before enforcing it.
Each setting should be a dictionary laid out with:
Keys as the names of browser features - a full list is available on the W3 Spec repository. The MDN article is also worth reading.
Values as lists of strings, where each string is either an origin, e.g. 'https://example.com', or of the special values 'self' or '*'. If there is just one value, no containing list is necessary. To represent no origins being allowed, use an empty list.
Note that in the header, domains are wrapped in double quotes - do not include these quotes within your Python string, as they will be added by the middleware.
If the keys or values are invalid, ImproperlyConfigured will be raised at instantiation time, or when processing a response. The current feature list is pulled from the JavaScript API with document.featurePolicy.allowedFeatures() on Chrome and Firefox. Browsers don’t always recognize all features, depending on the version and configuration. You may see warnings in the console for unavailable features in the header - these are normally safe to ignore, since django-permissions-policy already validates that you don’t have completely unknown names.
For backwards compatibility with old configuration, the value 'none' is supported in lists, but ignored - it’s preferable to use the empty list instead. It doesn’t make sense to specify 'none' alongside other values.
Middleware arguments
PermissionsPolicyMiddleware also accepts two keyword-only arguments, which take precedence over the equivalent settings:
policy - a dictionary in the same format as the PERMISSIONS_POLICY setting.
report_only_policy - a dictionary in the same format as the PERMISSIONS_POLICY_REPORT_ONLY setting.
When an argument is None (the default), the corresponding setting is used, and changes to it (such as with override_settings() in tests) take effect. When an argument is given, the setting is ignored for that instance, and the header value is computed and validated at instantiation time. Note that an empty dictionary ({}) is a value meaning “send no header”, which is different to None meaning “use the setting”.
Django only ever instantiates middleware with get_response, so these arguments are for when you construct instances yourself, such as within another middleware that dispatches between several instances.
Examples
Disable geolocation entirely, for the current origin and any iframes:
PERMISSIONS_POLICY = {
"geolocation": [],
}Allow autoplay from only the current origin and iframes from https://archive.org:
PERMISSIONS_POLICY = {
"autoplay": ["self", "https://archive.org"],
}Allow autoplay from all origins:
PERMISSIONS_POLICY = {
"autoplay": "*",
}Disable geolocation entirely, and test the effect of allowing autoplay from certain domains:
PERMISSIONS_POLICY = {
"geolocation": [],
}
PERMISSIONS_POLICY_REPORT_ONLY = {
"autoplay": ["self", "https://archive.org"],
}Decorators
Use the below decorators to override the permissions policies (live and report-only) on a per-view basis. The decorators fully replace the given policy set by the global settings for that view, rather than merging with it.
The examples below use function-based views. To decorate class-based views, use the @method_decorator per Django’s class-based view decoration documentation.
permissions_policy_override(config)
Overrides the Permissions-Policy header for the decorated view, using a dictionary in the same format as the PERMISSIONS_POLICY setting.
If config is an empty mapping ({}), no Permissions-Policy header will be added to the response for that view.
For example, to disable only geolocation on a particular view:
from django.shortcuts import render
from django_permissions_policy.decorators import permissions_policy_override
@permissions_policy_override(
{
"geolocation": [],
}
)
def puppy_park_view(request):
return render(request, "puppies/park.html")… or, to not set a permissions policy at all on a particular view:
from django.shortcuts import render
from django_permissions_policy.decorators import permissions_policy_override
@permissions_policy_override({})
def puppy_nap_view(request):
return render(request, "puppies/nap.html")permissions_policy_report_only_override(config)
Overrides the Permissions-Policy-Report-Only header for the decorated view, using a dictionary in the same format as the PERMISSIONS_POLICY_REPORT_ONLY setting.
If config is an empty mapping ({}), no Permissions-Policy-Report-Only header will be added to the response for that view.
For example, to test a policy that only restricts autoplay for a particular view:
from django.shortcuts import render
from django_permissions_policy.decorators import permissions_policy_report_only_override
@permissions_policy_report_only_override(
{
"autoplay": [],
}
)
def puppy_tricks_view(request):
return render(request, "puppies/tricks.html")…or, to not set a report-only permissions policy at all on a particular view:
from django.shortcuts import render
from django_permissions_policy.decorators import permissions_policy_report_only_override
@permissions_policy_report_only_override({})
def puppy_bath_view(request):
return render(request, "puppies/bath.html")1 maintainer
Metadata
1 maintainer
Release files for django-permissions-policy 4.34.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| django_permissions_policy-4.34.0.tar.gz | 8.7 kB | With provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| django_permissions_policy-4.34.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 18.0 kB
Release files / django_permissions_policy-4.34.0.tar.gz
| Download URL | django_permissions_policy-4.34.0.tar.gz |
|---|---|
| Size | 8.7 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
5026d2de614de1e29eb06fbf89e3a89b9fcda50a3e8f918c058f091e5b0dbd1f
|
|
BLAKE2b-256 checksum How to use checksums |
fd8602b1ce8cf345a59ec93538994760497d6cd6bc881621235c185f021c0804
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.13
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 16, 2026.
Transparency logRelease files / django_permissions_policy-4.34.0-py3-none-any.whl
| Download URL | django_permissions_policy-4.34.0-py3-none-any.whl |
|---|---|
| Size | 9.3 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
3022c1a067b80fadf6e79788b4bd379bfb5b16a51e8f43bdbee526a5c08db0eb
|
|
BLAKE2b-256 checksum How to use checksums |
45791f12cf6c14dfd7d83e0b7e108a17999a6377938b53ee5542dda21a63bbf2
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.13
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 16, 2026.
Transparency logSecurity for django-permissions-policy 4.34.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for django_permissions_policy-4.34.0.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 16, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
