This tool is designed to evaluate browser features and determine whether they are powerful or restricted by policy. To achieve this, I created a simple prototype inspired by the concept of privacytests.org. This project is open-source, and the code is available for access (Github code). In essence, the tool evaluates each known permission listed in its codebase to determine whether it is powerful and/or controlled by policy. To check if a permission is powerful, the tool leverages the navigator.permissions.query
function. For testing policy-controlled features, it utilizes the Permissions-Policy header
.
As noted, however, this header is currently not supported in Firefox or WebKit. That said, the lack of support for the header does not imply that these browsers fail to implement inheritance to iframes using the allow
attribute.
If you're not familiar with how browser permissions work, I wrote a blog on the topic. In it, I explain what browser permissions are, their key characteristics, common misconceptions among developers, and much more. I highly recommend checking it out! Link to Browser Permissions blog.