Permissions-Policy Auditor

Fetches one public URL and deeply audits its Permissions-Policy and legacy Feature-Policy response headers. Parses each feature directive and allowlist, classifies sensitive and high-risk browser features (camera, microphone, geolocation, payment, USB, Bluetooth, NFC, clipboard, notifications, MIDI, serial, and more), flags over-permissive wildcards, missing high-risk feature restrictions, deprecated Feature-Policy usage, and conflicting dual headers. Returns a readiness score, letter grade, issues, and recommendations. Built for security teams, devops engineers, frontend platform teams, site migration QA, and agency consultants.

Use cases

• Verify a deployed Permissions-Policy blocks sensitive browser features (camera, microphone, geolocation) from third-party iframes after a release.
• Detect high-risk features allowed with * that expose the page to cross-origin feature abuse.
• Catch missing high-risk feature restrictions so features default to allowed in the absence of explicit policy.
• Identify and migrate from the deprecated Feature-Policy header to the modern Permissions-Policy syntax.
• Flag conflicting dual headers where both Permissions-Policy and Feature-Policy are set and browsers may apply conflicting rules.
• Run scheduled checks on critical origins to catch Permissions-Policy configuration drift on edge servers or CDN cutovers.
• Feed structured results into security QA dashboards or CI pipelines.

Input

Field	Type	Description
startUrl	string	Public HTTP or HTTPS URL to audit. URLs with credentials and private network targets are rejected.
timeoutSeconds	integer	Request timeout from 3 to 30 seconds. Defaults to 10.

Output

The actor pushes one dataset item per run.

Field	Type	Description
inputUrl	string	Original URL from input.
normalizedInputUrl	string	Normalized input URL after defaulting the scheme.
finalUrl	string	Final page URL after redirects.
https	boolean	True when the final URL is HTTPS.
ok	boolean	True when the fetch succeeded.
checkedAt	string	ISO timestamp for the audit.
httpStatus	integer or null	HTTP status code from the response.
hasPermissionsPolicy	boolean	True when a Permissions-Policy header is present.
hasFeaturePolicy	boolean	True when a legacy Feature-Policy header is present.
rawPermissionsPolicy	string or null	Raw Permissions-Policy header value.
rawFeaturePolicy	string or null	Raw Feature-Policy header value.
directives	array	Parsed feature directives, each with feature, allowlist, allowAll, allowSelf, allowNone, raw, isSensitive, isHighRisk, and issues.
directiveCount	integer	Number of parsed feature directives.
highRiskFeaturesManaged	array	High-risk features explicitly mentioned in the policy.
highRiskFeaturesMissing	array	High-risk features not mentioned in the policy (defaulting to allowed).
highRiskFeaturesAllowedAll	array	High-risk features allowed for all origins (*).
score	integer	Permissions-Policy readiness score from 0 to 100.
grade	string	Letter grade from A+ to F.
issues	array	Human-readable issues.
recommendations	array	Suggested fixes.
error	string or null	Fetch-level error, if the request failed.

Example input

{
  "startUrl": "https://example.com/",
  "timeoutSeconds": 10
}

Example output

{
  "inputUrl": "https://example.com/",
  "normalizedInputUrl": "https://example.com/",
  "finalUrl": "https://example.com/",
  "https": true,
  "ok": true,
  "checkedAt": "2025-01-01T00:00:00.000Z",
  "httpStatus": 200,
  "hasPermissionsPolicy": true,
  "hasFeaturePolicy": false,
  "rawPermissionsPolicy": "camera=(), microphone=(), geolocation=(), payment=(), usb=()",
  "rawFeaturePolicy": null,
  "directives": [
    {
      "feature": "camera",
      "allowlist": [],
      "allowAll": false,
      "allowSelf": false,
      "allowNone": true,
      "raw": "camera=()",
      "isSensitive": true,
      "isHighRisk": true,
      "issues": [
        {
          "severity": "info",
          "message": "High-risk feature \"camera\" is fully denied; this is the safest posture if the feature is not needed."
        }
      ]
    },
    {
      "feature": "microphone",
      "allowlist": [],
      "allowAll": false,
      "allowSelf": false,
      "allowNone": true,
      "raw": "microphone=()",
      "isSensitive": true,
      "isHighRisk": true,
      "issues": [
        {
          "severity": "info",
          "message": "High-risk feature \"microphone\" is fully denied; this is the safest posture if the feature is not needed."
        }
      ]
    }
  ],
  "directiveCount": 5,
  "highRiskFeaturesManaged": ["camera", "microphone", "geolocation", "payment", "usb"],
  "highRiskFeaturesMissing": ["bluetooth", "nfc", "clipboard-read", "notifications", "push", "midi", "serial", "hid", "display-capture"],
  "highRiskFeaturesAllowedAll": [],
  "score": 73,
  "grade": "B",
  "issues": [
    "9 high-risk feature(s) are not mentioned in the policy (defaulting to allowed): bluetooth, nfc, clipboard-read, notifications, push, midi, serial, hid, display-capture."
  ],
  "recommendations": [
    "9 high-risk feature(s) are not mentioned in the policy (defaulting to allowed): bluetooth, nfc, clipboard-read, notifications, push, midi, serial, hid, display-capture.",
    "Add the following high-risk features to the Permissions-Policy: bluetooth, nfc, clipboard-read, notifications, push, midi, serial, hid, display-capture. Deny them with () if not needed."
  ],
  "error": null
}

Security

• Only public HTTP and HTTPS URLs are fetched.
• URLs with usernames or passwords are rejected.
• Private IPv4, private IPv6, localhost, link-local, and private DNS resolutions are blocked before fetching.
• Redirect destinations are revalidated before they are followed.
• The actor does not require logins, cookies, browser sessions, or credentials.
• The actor fetches headers only; it does not fetch any URLs referenced inside the policy.

Pricing

Event	Suggested price
Actor start	$0.005
URL audited	$0.01

Suggested launch price: about $0.015 per audited URL. Teams can schedule the actor for recurring checks on important origins after deploys and CDN cutovers.

FAQ

Does this actor crawl multiple URLs or a whole site?

No. It fetches one URL per run. This keeps runs cheap and predictable for CI and scheduled monitoring.

How does the score work?

The score starts at 100 and is reduced for: high-risk features allowed with * (-15 each, capped at -40), sensitive non-high-risk features allowed with * (-5 each, capped at -20), missing high-risk features not mentioned in the policy (-3 each, capped at -25), legacy Feature-Policy usage (-10), conflicting dual Permissions-Policy + Feature-Policy headers (-5), and sensitive features with specific third-party origins (-3 each, capped at -10). A bonus of +5 is added when all high-risk features are restricted to self or (). Policies that are entirely absent receive an F.

Which features are considered high-risk?

Camera, microphone, geolocation, payment, USB, Bluetooth, NFC, clipboard-read, notifications, push, MIDI, serial, HID, and display-capture. These features have significant privacy or security implications and should be explicitly restricted.

What is the difference between this actor and the HTTP Security Headers Auditor?

The HTTP Security Headers Auditor checks ten security response headers at a high level and treats Permissions-Policy as one of them, reporting only whether the header is present or absent. This Permissions-Policy Auditor is specialized: it parses every feature directive and allowlist, classifies sensitive and high-risk features, flags over-permissive wildcards, detects missing high-risk restrictions, identifies the deprecated Feature-Policy header, checks for conflicting dual headers, and returns a recommended hardening path for Permissions-Policy specifically.

What is the difference between Permissions-Policy and Feature-Policy?

Feature-Policy is the deprecated predecessor of Permissions-Policy. It uses a different syntax (semicolons, quoted tokens) and is no longer recommended. Permissions-Policy uses comma-separated directives with parenthesized allowlists. Browsers may apply conflicting rules if both are set, so the actor flags this case and recommends removing the legacy header.

Does the actor check the Reporting API or CSP report-only headers?

No. Those are covered by the Content-Security-Policy Auditor. This actor focuses exclusively on Permissions-Policy and Feature-Policy feature restriction headers.