The target member

The OPTIONAL target member defines the scope in which the directive is enforced. The member's name is "`target`" and the recognized values are either an array of serialized origins which may contain the "`self`" keyword that refers to current global's origin, or the string "`\*`". If an unknown value is specified, or if no member named "`target`" is present in the object, the directive's target will be set to "`\*`".

The disable member

The OPTIONAL disable member defines the disable policy for the directive. The member's name is "`disable`" and the value is a list of ASCII strings.

The enable member

The OPTIONAL enable member defines the enable policy for the directive. The member's name is "`enable`" and the value is a list of ASCII strings. [response]

`Feature-Policy` HTTP Header Field

The Feature-Policy HTTP header field can be used both in the [response] (server to client) and a [request] (client to server) to communicate the feature policy. In the former case, the server is communicating the desired policy that should be enforced by the client, and in the latter, the client is communicating the policy that it will enforce.

The header's value is represented by the following ABNF [[!RFC5234]]:

          Disable = 1#json-field-value
                    ; See Section 2 of [[HTTP-JFV]], and Section 2 of [[RFC7159]]
        

When the user agent receives a `Feature-Policy` header field, it MUST process and enforce the serialized policy as described in . When the user agent [performs a fetch][fetching algorithm], it MUST advertise the active feature policy as described in .

Process response policy

Given a [response] (response) and [global object] (global), this algorithm returns a feature policy.

1. Abort these steps if the response’s [header list] does not contain a [header] whose [name] is "`Feature-Policy`".
2. Let header be the [value] of the [header] in response’s [header list] whose name is "`Feature-Policy`".
3. Let feature policy be the result of executing on header and global.

The `meta` element

A [Document] may deliver a policy via one or more HTML [meta] elements whose [http-equiv] attributes are an [ASCII case-insensitive] match for the string "`Feature-Policy`". For example:

<meta http-equiv="Feature-Policy"
  content='{"disable": ["webrtc"]},
           {"enable":["geolocation"],"target":["https://example.com"}'>
        

The `meta` policy is processed as defined in and modifications to the [content][meta-content] attribute of a `meta` element after the element has been parsed MUST be ignored.

TODO: talk about effect of multiple policies

Parse policy from value and global

Given a string (value) and [global object] (global) this algorithm will return a feature policy.

1. Let list be the result of executing the algorithm defined in Section 4 of [[!HTTP-JFV]]. If that algorithm results in an error, abort these steps.
2. Let policy be an empty list.
3. For each item in list:
   1. Let target be an empty list.
   2. If item has a target member whose value is an array, then for each origin in the array:
      1. If origin is an [ASCII case-insensitive] match for "`self`", let result be the global's origin.
      2. Otherwise, let result be the result of executing the [URL parser] on origin
      3. If result is not `failure`, then append the [origin of result][origin-of-url] to target.
   3. If target is still an empty list, set target to "`\*`".
   4. Let disable be the result of executing on the item's disable member's value.
   5. Let enable be the result of executing on the item's enable member's value.
   6. Let tuple be a new directive tuple whose values are set as follows:

      "`target`"

      Set to target.

      "`disable`"

      Set to disable.

      "`enable`"

      Set to enable.

   7. Append tuple to policy.
4. Return policy.

`cookie`

partial interface Document {
  [Feature=cookie] attribute USVString cookie;
};

The cookie keyword controls whether the [cookie attribute] is [exposed] for [current global object].

1. The default enable policy is `\*` for [top-level browsing context], and `\*` for [nested browsing context].
2. The default disable policy is `null`.

`domain`

partial interface Document {
  [Feature=domain] attribute USVString domain;
};

The domain keyword controls whether the [domain attribute] is [exposed] for [current global object].

1. The default enable policy is `\*` for [top-level browsing context], and `\*` for [nested browsing context].
2. The default disable policy is `null`.

`docwrite`

partial interface Document {
  [CEReactions, Feature=docwrite] void write(DOMString... text);
  [CEReactions, Feature=docwrite] void writeln(DOMString... text);
};

The docwrite keyword controls whether the [document.write] and [document.writeln] methods are [exposed] for [current global object].

1. The default enable policy is `\*` for [top-level browsing context], and `\*` for [nested browsing context].
2. The default disable policy is `null`.

`geolocation`

partial interface Navigator {
  [Feature=geolocation] readonly attribute Geolocation geolocation;
};

The geolocation keyword controls whether the [Geolocation interface] ([[!GEOLOCATION-API]]) is [exposed] for [current global object].

1. The default enable policy is `self` for [top-level browsing context], and `null` for [nested browsing context].
2. The default disable policy is `null`.

`midi`

partial interface Navigator {
  [Feature=midi] Promise<MIDIAccess> requestMIDIAccess (optional MIDIOptions options);
};

The midi keyword controls whether the [requestMIDIAccess method] ([[!WEBMIDI]]) is [exposed] for [current global object].

1. The default enable policy is `self` for [top-level browsing context], and `null` for [nested browsing context].
2. The default disable policy is `null`.

`notifications`

[Constructor(DOMString title, optional NotificationOptions options),
Feature=notifications]
interface Notification : EventTarget {};

The notifications keyword controls whether the [Notification interface] ([[!NOTIFICATIONS]]) is [exposed] for [current global object].

1. The default enable policy is `self` for [top-level browsing context], and `null` for [nested browsing context].
2. The default disable policy is `null`.

`payment`

[Constructor(sequence<PaymentMethodData> methodData, PaymentDetails details, optional PaymentOptions options),
 SecureContext, Feature=payment]
interface PaymentRequest : EventTarget {};

The payment keyword controls whether the [PaymentRequest interface] ([[!PAYMENT-REQUEST]]) is [exposed] for [current global object].

1. The default enable policy is `self` for [top-level browsing context], and `null` for [nested browsing context].
2. The default disable policy is `null`.

`push`

partial interface ServiceWorkerRegistration {
  [Feature=push] readonly attribute PushManager pushManager;
};

[Feature=push]
interface PushManager {};

The push keyword controls whether the [PushManager interface] ([[!PUSH-API]]) is [exposed] for [current global object].

1. The default enable policy is `self` for [top-level browsing context], and `null` for [nested browsing context].
2. The default disable policy is `null`.

`sync-script`

The sync-script keyword controls use of synchronous `script` elements, as defined in . When this feature is disabled, such scripts are ignored by the user agent.

  Feature-Policy: {"disable":["sync-script"]}

  <script src="/script1.js"></script>
  <script src="/script2.js" async></script>
  <script src="/script3.js" defer></script>
  <script>
    const scriptEl = document.createElement("script");
    scriptEl.src = "/script4.js";
    document.body.appendChild(scriptEl);
  </script>

`sync-xhr`

The sync-xhr keyword controls use of synchronous `XMLHttpRequest` API, as defined in . When [open() method](xhr-open) is called with async argument set to false, an `InvalidAccessError` except will be thrown.

  Feature-Policy: {"disable":["sync-xhr"]}

  var xhr = new XMLHttpRequest();
  xhr.open("GET", "/foo", false);

`usermedia`

[Exposed=Window, NoInterfaceObject, Feature=usermedia]
interface NavigatorUserMedia {
    [SameObject] readonly attribute MediaDevices mediaDevices;
};

The usermedia keyword controls whether the [NavigatorUserMedia interface] ([[!MEDIACAPTURE-API]]) is [exposed] for [current global object].

1. The default enable policy is `self` for [top-level browsing context], and `null` for [nested browsing context].
2. The default disable policy is `null`.

`vibrate`

partial interface Navigator {
  [Feature=vibrate] boolean vibrate(VibratePattern pattern);
};

The vibrate keyword controls whether the [vibrate method] ([[!VIBRATION]]) is [exposed] for [current global object].

1. The default enable policy is `self` for [top-level browsing context], and `null` for [nested browsing context].
2. The default disable policy is `null`.

`webrtc`

[Constructor(optional RTCConfiguration configuration), Feature=webrtc]
interface RTCPeerConnection : EventTarget {};

The webrtc keyword controls whether the [RTCPeerConnection interface] ([[!WEBRTC]]) is [exposed] for [current global object].

1. The default enable policy is `\*` for [top-level browsing context], and `\*` for [nested browsing context].
2. The default disable policy is `null`.

Parse disable features

Given a list, this algorithm returns a list of features, which may be empty.

1. Let valid-features be an empty list.
2. If list is null or empty, return valid-features.
3. For each item in list:
   1. Convert item to ASCII-lowercase.
   2. If item's string value is not one of the features, ignore item, and continue to the next item.
   3. Append item to valid-features.
4. Return valid-features.

Parse enable features

Given a list, this algorithm returns a list of features, which may be empty.

1. Let valid-features be an empty list.
2. If list is null or empty, return valid-features.
3. For each item in list:
   1. Convert item to ASCII-lowercase.
   2. TODO... should we merge/refactor this with disable parse?
   3. Append item to valid-features.
4. Return valid-features.

Initialize global's Feature Policy from response

Given a [response] (response) and a global object (global), this algorithm populates global's Feature Policy List

1. If global is a `Window` and its `Document` has a parent browsing context or opener browsing context (context):
   1. Let document be the active document in context.
   2. For each directive in document's Feature Policy List:
      1. Add directive to global's `Document`'s Feature Policy List if any of the following are true:
         1. directive's target is "`\*`"
         2. directive's target is an array containing global's origin
         3. response's url's scheme is a local scheme
2. If global is a `WorkerGlobalScope`:
   1. For each document in global's documents:
      1. For each directive in document's Feature Policy List:
         1. Add directive to global's Feature Policy List if either of the following are true:
            1. directive's target is "`\*`"
            2. directive's target is an array containing global's origin
            3. response's url's scheme is a local scheme
3. Let policy be the result of executing on response and global.
4. Enforce the policy policy.

Is feature disabled for global?

Given a string (feature) and a global object (global), this algorithm returns "`Disabled`" if feature should be considered disabled, and "`Enabled`" otherwise.

1. Let policy be global's Feature Policy List
2. If policy is empty, return "`Enabled`".
3. For each directive in policy:
   1. If directive's disable contains feature:
      1. Return "`Disabled`".
4. Return "`Enabled`".

Set request policy

This monkey patches [fetching algorithm], by inserting the following steps after current step #4:

1. If [request]'s [client] is not null and has a non-empty feature policy list, run the following steps:
   1. Let policy be the [current global object]'s feature policy list.
   2. Let serialized feature policy be the result of executing the [sender requirements] algorithm on policy, as defined in section 3 of [[!HTTP-JFV]].
   3. [Append](header-append) Feature-Policy/serialized feature policy to request's [header list].

[Feature]

If the [Feature] [extended attribute] appears on an interface, partial interface, or an individual interface member, it indicates that the interface or interface member is subject to feature policy associated with the ECMAScript global environment's global object.

The [Feature] [extended attribute] must [take an identifier], which must be a [global name].

Whether a construct that the [Feature] [extended attribute] can be specified on is enabled by feature policy for global is defined as follows:

1. If the [Feature] [extended attribute] is specified on the construct, then it is enabled by feature policy for global if the "is feature disabled for global?" algorithm returns "`Enabled`" when executed upon the extended attribute's argument and the ECMAScript global environment's global object.
2. Otherwise, if the [Feature] [extended attribute] does not appear on a construct, then it is enabled by feature policy for global, depending on the type of construct:
   1. **Interface**: the interface or dictionary is implicity "`Enabled`" by feature policy.
   2. **Partial interface**: the partial interface is enabled by feature policy for global if and only if the original interface definition is.
   3. **Interface member**: the interface member is enabled by feature policy for global if and only if the interface or partial interface the member is declared on is.

Whether a construct is enabled by feature policy for global influences whether it is [exposed] in a given ECMAScript global environment.