Permissions Policy Parser

Parse feature allowlists from Permissions-Policy dictionary syntax, supporting wildcard, self, and quoted origins without evaluating permissions.

Description

Permissions-Policy declarations pair features with allowlists.

Permissions-Policy declarations pair features with allowlists. Parsing those declarations cannot alone determine permissions after inheritance, embedding and browser support are considered.^[1]

Parse feature allowlists from Permissions-Policy dictionary syntax, supporting wildcard, self, and quoted origins without evaluating permissions.

When to use Permissions Policy Parser

Use this tool to parse feature allowlists from Permissions-Policy dictionary syntax, supporting wildcard, self, and quoted origins without evaluating permissions.

Choose the URL, decoded source text, header value or explicit byte list requested by this tool. Paste the complete relevant input and follow its parsing and encoding conventions.

How to use Permissions Policy Parser and understand its results

Choose the URL, decoded source text, header value or explicit byte list requested by this tool. Paste the complete relevant input and follow its parsing and encoding conventions.
Enter header using the field table and calculation rules, then run the tool.
Read features. The explanation below defines the units, signs, ordering and any flags or placeholder values.
If the tool reports an input issue, correct the values and run it again. Apply the stated assumptions when interpreting a successfully returned result.

Input field	Meaning	Value type; see rules below	Requirement
header	Permissions-Policy field value.	string; maximum length: 1000000	Required

Paste the field value. Split balanced comma-separated declarations, require lowercase feature syntax and parse wildcard or parenthesized self/quoted entries. Decode supported quoted escapes, retain declaration order and reject duplicate feature names or unsupported syntax. Empty parentheses give an empty allowlist.

features=parse unique feature=(self and/or quoted origins), feature=(), or feature=*

Units, indexing, boundary conditions and exceptional cases are defined in the calculation rules above.

Output field	Meaning	Value type
features	Declared feature allowlists.	list of object; minimum entries: 0; maximum entries: 100000

json

{
  "input": {
    "header": "camera=(), geolocation=(self \"https://maps.example\"), fullscreen=*"
  },
  "output": {
    "features": [
      {
        "feature": "camera",
        "allowlist": []
      },
      {
        "feature": "geolocation",
        "allowlist": [
          "self",
          "https://maps.example"
        ]
      },
      {
        "feature": "fullscreen",
        "allowlist": [
          "*"
        ]
      }
    ]
  }
}

Limitations and assumptions

Feature names and origin strings are not validated against a browser registry or URL parser. This does not evaluate an iframe's effective permissions, document inheritance or API availability.

Numeric inputs must be finite. Follow the calculation-specific rules for overflow, underflow and exceptional cases. Extremely large text inputs are rejected. Missing required fields, extra fields, wrong value types and violations of the calculation rules are input errors.

Alternative or Complementary methods

Use Content Security Policy Parser: Parse one serialized CSP policy into lowercase directive names and source tokens, keeping the first occurrence of each directive. For a complementary task, use URL Origin: Extract the origin of an absolute URL using the WHATWG URL parser, including its normalization rules.

References

Permissions Policy Parser — tool.io

Similar or alternative tools

Content Security Policy Parser
Parse one serialized CSP policy into lowercase directive names and source tokens, keeping the first occurrence of each directive.
URL Origin
Extract the origin of an absolute URL using the WHATWG URL parser, including its normalization rules.