Remove error messages when using an unrecognized feature with Feature-Policy in Chrome

Question

I'm adding Feature-Policy in HTTP headers of an application. It works well but I have this kind of messages on Chrome :

Error with Feature-Policy header: Unrecognized feature: 'document-domain'.

This feature isn't recognized by Chrome but it is with Firefox. This messages cause problems on the test suite of the app.

I checked in the list of switches we can use with Chrome but didn't found the right one. I know it's probably possible to change header depending off the browsers used but this is a pain in the ass. The ideal would be to add something in headers.

What's the best solution ?

Answer 1

You need to use correct (newer) version of Chrome

See table of Feature-Policy features vs. version of Chrome, that accepts them https://github.com/w3c/webappsec-permissions-policy/blob/master/features.md

I've just tested with current Chrome versions

With header like

feature-policy: autoplay 'self'; camera 'none'; document-domain 'self'; encrypted-media 'self'; fullscreen 'self'; geolocation 'none'; microphone 'none'; midi 'none'; payment 'none'; xr-spatial-tracking 'none';

• Chrome Stable (84.0.4147.125) - does not complain about document-domain
• Chrome Beta (85.0.4183.59) - does not complain about document-domain
• Chrome Unstable (86.0.4221.3) - does not complain about document-domain

---

If you're unable to use newer Chrome version, CLI flag mentioned in linked w3c document, should help you

--enable-blink-features=ExperimentalProductivityFeatures

---

Also, be careful with how the header is formulated, some of the features changed name over time (eg. vr (old) => xr-spatial-tracking (new))

And the origin must be correctly enclosed by single-quotes

# wrong
Feature-Policy: autoplay self; camera none;
# correct
Feature-Policy: autoplay 'self'; camera 'none';

---

And last, but not least, seems like the Feature-Policy header will get renamed to Permissions-Policy and the syntax for declaring allowed origins for features will change as well

See for reference:

• https://github.com/securityheaders/securityheaders-bugs/issues/77
• https://w3c.github.io/webappsec-permissions-policy/document-policy.html
• https://w3c.github.io/webappsec-permissions-policy/
• https://www.w3.org/TR/permissions-policy-1/