Legacy Feature-Policy header also set

Safari does not recognize the Permissions-Policy header name — it only supports the older Feature-Policy header. Sites that configure Permissions-Policy without a matching Feature-Policy leave Safari users with no API restrictions at all: camera, microphone, geolocation, and payment APIs remain unrestricted for embedded content. CWE-693 applies when a protection mechanism is deployed in a way that bypasses it for a significant user segment. OWASP A05 flags browser-specific security header gaps as misconfiguration — partial cross-browser coverage is operationally equivalent to no coverage for affected users.

Set both Permissions-Policy (Chromium/Firefox) and Feature-Policy (Safari) with matching restrictions. The syntax differs: Feature-Policy uses 'none' instead of () and semicolons instead of commas.

headers: [
  {
    key: 'Permissions-Policy',
    value: 'camera=(), microphone=(), geolocation=()'
  },
  {
    key: 'Feature-Policy',
    value: "camera 'none'; microphone 'none'; geolocation 'none'"
  }
]

Skip this step only if you have confirmed your deployment target is Chromium-only (Chrome extension, Electron app, kiosk). For public web apps, both headers are required.