Permissions-Policy: bluetooth directive
Limited availability
This feature is not Baseline because it does not work in some of the most widely-used browsers.
Experimental: This is an experimental technology
Check the Browser compatibility table carefully before using this in production.
The HTTP Permissions-Policy header bluetooth directive controls whether the current document is allowed to use the Web Bluetooth API.
Specifically, where a defined policy disallows use of this feature, the methods of the Bluetooth object returned by Navigator.bluetooth, will block access:
Bluetooth.getAvailability()will always fulfill its returnedPromisewith a value offalse.Bluetooth.getDevices()will reject its returnedPromisewith aSecurityErrorDOMException.Bluetooth.requestDevice()will reject its returnedPromisewith aSecurityErrorDOMException.
Syntax
Permissions-Policy: bluetooth=<allowlist>;
<allowlist>-
A list of origins for which permission is granted to use the feature. See
Permissions-Policy> Syntax for more details.
Default policy
The default allowlist for bluetooth is self. The top-level browsing context and same-origin iframes are allowed access to the bluetooth feature by default.
Examples
Basic usage
SecureCorp Inc. wants to disallow bluetooth within all browsing contexts except for its own origin and those whose origin is https://example.com. It can do so by delivering the following HTTP response header to define a Permissions Policy:
Permissions-Policy: bluetooth=(self "https://example.com")
Then include an allow attribute on the <iframe> element:
<iframe src="https://example.com/blue" allow="bluetooth"></iframe>
Note:
Specifying the Permissions-Policy header in this manner disallows bluetooth for other origins, even if they would be allowed by the <iframe> allow attribute.
Using the default policy
FastCorp Inc. wants to allow bluetooth in a specific cross-origin child frame. Since the default allowlist for bluetooth is self, it can do so by including an allow attribute on the <iframe> element:
<iframe src="https://other.com/blue" allow="bluetooth"></iframe>
Specifications
| Specification |
|---|
| Web Bluetooth # permissions-policy |