Sensitive APIs restricted (camera, microphone, geolocation)

Camera, microphone, and geolocation are the three browser APIs with direct real-world privacy consequences: an app that inadvertently grants a third-party script access to the mic or camera exposes users to surveillance, and geolocation exposure is a physical safety risk. Without Permissions-Policy restrictions, embedded ads, analytics scripts, or compromised CDN resources can request these sensitive APIs. CWE-693 applies — the browser's permission prompt is a protection mechanism, but a missing Permissions-Policy allows any embedded script to trigger that prompt, bypassing user intent. OWASP A05 flags unnecessary API exposure as a security misconfiguration.

Disable all three sensitive APIs in Permissions-Policy unless your application actively uses them. If you do use one, restrict it to same-origin with (self).

// next.config.js
headers: [{
  source: '/(.*)',
  headers: [{
    key: 'Permissions-Policy',
    value: 'camera=(), microphone=(), geolocation=()'
  }]
}]

For a Next.js app that uses geolocation for location-based features: geolocation=(self) restricts the API to your origin only, blocking embedded content from requesting location while preserving your own functionality.