Permissions Policy Guide

How to Test a New Feature with permissions policy

This directory contains a framework to test features with permissions policy.

When adding a new feature to permissions policy, the following cases should be tested:

• feature enabled by header policy [HTTP tests]
  • test when feature is enabled by permissions policy HTTP header;
• feature disabled by header policy [HTTP tests]
  • test when feature is disabled by permissions policy HTTP header;
• feature enabled on self origin by header policy [HTTP tests]
  • test when feature is enabled only on self origin by permissions policy HTTP header.
• feature allowed by container policy (iframe “allow” attribute);
  • test when feature is enabled by iframe “allow” attribute on self and cross origins.
• feature allowed by container policy, redirect on load.
  • test when feature is enabled by iframe “allow” attribute when the iframe is being redirected to a new origin upon loading

How to Use the Test Framework

Use test_feature_availability() defined in /permissions-policy/resources/permissions-policy.js. Please refer to the comments in /permissions-policy/resources/permissions-policy.js for how this function works.

How to Write Header Policy Tests

HTTP tests are used to test features with header policy.

• Define the header policy in <feature-name>-<enabled | disabled | enabled-on-self-origin>-by-permissions-policy.https.sub.html.headers. Example:

  Permissions-Policy: feature-name=*

• In <feature-name>-<enabled | disabled | enabled-on-self-origin>-by-permissions-policy.https.sub.html:

• test if feature is enabled / disabled in the main frame;

• test if feature is enabled / disabled in a same-origin iframe;

• test if feature is enabled / disabled in a cross-origin iframe.

Examples: /permissions-policy/payment-disabled-by-permissions-policy.https.sub.html /permissions-policy/payment-disabled-by-permissions-policy.https.sub.html.headers

How to Write Container Policy Tests

Simply use test_feature_availability() with the optional argument feature_name specified to test if:

• feature is enabled / disabled in a same-origin iframe;
• feature is enabled / disabled in a cross-origin iframe.

Example: /permissions-policy/payment-allowed-by-permissions-policy-attribute.https.sub.html

How to Write Container Policy Tests with Redirect

Similar to the section above, append /permissions-policy/resources/redirect-on-load.html# to the argument src passed to test_feature_availability().

Example: /permissions-policy/payment-allowed-by-permissions-policy-attribute-redirect-on-load.https.sub.html