demo · v132

Who can issue / redeem now?

Before v132 the default was self — same-origin iframes only. With the wildcard default, cross-origin iframes can also exercise PST unless the parent page sets a stricter Permissions-Policy header. Try it.

issuance (token issuance)

same-origintop frameallowed
same-origin iframesame as top—
cross-origin iframeads.example—

redemption

same-origintop frameallowed
same-origin iframesame as top—
cross-origin iframeanalytics.example—

generated header

see also