Rename Feature-Policy header to Permissions-Policy

[yosifeldman]

According to the following link, the Feature-Policy header is now renamed to the Permissions-Policy.

https://www.w3.org/TR/permissions-policy-1/

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy

Since yesterday (July 20 2020) started to get errors in Console in the Chrome:
"Error with Feature-Policy header: Unrecognized feature: 'display-capture'."

[J2TEAM]

Hi @bepsvpt! Can you please update it soon? It shows a lot of errors on my website 😢

[yosifeldman]

I did my own class that extends their class and rename it myself. The errors are gone. Also you can simply disable this section in config/secure-headers.php. Still will appreciate it to be fixed in the package... чт, 30 июл. 2020 г., 21:18 JUNO_OKYO <notifications@github.com>:

…

Hi @bepsvpt <https://github.com/bepsvpt>! Can you please update it soon? It shows a lot of errors on my website 😢 [image: image] <https://user-images.githubusercontent.com/5250117/88958907-571e0280-d2cb-11ea-8ff4-e0c703ff8d91.png> — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#51 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ACLIQ7OG66AQCJ4NQ3RUO2LR6G2OHANCNFSM4PDOWESQ> .

[jamesparkes]

any updates on this one?

[bepsvpt]

6.2.0 adds use-permissions-policy-header config key to feature-policy, set it to true will use Permissions-Policy header name.

https://github.com/bepsvpt/secure-headers/blob/6.2.0/config/secure-headers.php#L148-L159

[jamesparkes]

worked like a charm. thanks 😄

[richardnbanks]

The header gets changed correctly but the format of the values changed too.

https://github.com/w3c/webappsec-permissions-policy/blob/master/permissions-policy-explainer.md#appendix-big-changes-since-this-was-called-feature-policy

A policy which would previously have been expressed as:

Feature-Policy: fullscreen 'self' https://example.com https://another.example.com; geolocation *; camera 'none'

would now look like:

Permissions-Policy: fullscreen=(self "https://example.com" "https://another.example.com"), geolocation=*, camera=()

[HDVinnie]

Came across this as well after using https://observatory.mozilla.org/ . Hope to see it implemented and released.

[bepsvpt]

7.0.0 was released, if there is any problem with permissions-policy, feel free to reply on this issue.

Note: Feature-Policy was removed.