fix(headers): allow the microphone on our own origin - #888
Merged
Conversation
Permissions-Policy sent `microphone=()` — an EMPTY allowlist, which denies
the feature to every origin INCLUDING this one. The browser therefore never
shows a permission prompt at all; getUserMedia rejects immediately with
NotAllowedError.
Measured on orangecat.ch before this change:
document.featurePolicy.allowsFeature('microphone') -> false
navigator.permissions.query({name:'microphone'}) -> "denied"
That silently disabled speak-to-report in the embedded FleetCrown feedback
widget, and no visitor could fix it — there was nothing to allow. The
symptom read as "Microphone permission denied", which points at the person
rather than at the header actually responsible.
`(self)` permits this origin only, so the browser asks the person — which
is the decision that should be theirs. camera and geolocation stay fully
denied: nothing here uses them, and an unused capability should not be
reachable.
npm run verify passes (282 files, 2648 tests).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Permissions-Policysentmicrophone=()— an empty allowlist, which denies the feature to every origin including this one. The browser therefore never shows a permission prompt at all;getUserMediarejects immediately withNotAllowedError.Measured on orangecat.ch before this change:
That silently disabled speak-to-report in the embedded FleetCrown feedback widget, and no visitor could fix it — there was nothing to allow. The symptom read as "Microphone permission denied", which points at the person rather than at the header actually responsible.
The change
(self)permits this origin only, so the browser asks the person — which is the decision that should be theirs. It does not grant the mic to embedded third-party frames.cameraandgeolocationstay fully denied: nothing here uses them, and an unused capability should not be reachable.Verification
npm run verifypasses — 282 test files, 2648 tests.Companion fix in bitbaum/fleetcrown#474 makes the widget detect a policy block and hide the mic button entirely, so sites that keep
microphone=()degrade silently instead of showing a control that can only fail. That half is central; this half cannot be —Permissions-Policyis the host document's decision by design.