Permissions-Policy header restricts sensitive APIs

Without Permissions-Policy, any JavaScript executing on your page — including third-party analytics scripts, embedded widgets, and compromised CDN assets — can request access to the user's camera, microphone, and geolocation without additional browser prompts. If an XSS payload fires or a third-party script is compromised, it can silently activate hardware sensors. CWE-732 (Incorrect Permission Assignment) and OWASP A05 (Security Misconfiguration) both apply to unrestricted browser API exposure. Restricting permissions you don't use follows the principle of least privilege: a payment app has no legitimate reason to access the gyroscope.

Add a Permissions-Policy header that explicitly denies browser APIs your app doesn't use. Deny everything you don't need — you can always add specific origins later.

// next.config.js
headers: [{
  key: 'Permissions-Policy',
  value: 'camera=(), microphone=(), geolocation=(), payment=(), usb=()'
}]

The () syntax denies the feature for all origins, including your own pages. Use (self) to allow the feature only for your own origin. If you do need camera access (e.g., for a video feature), set camera=(self) instead of allowing it globally.