v140 · device

Permissions policy for Device Attributes API

The new Permissions Policy enables restricting access to the Device Attributes API, which is available only for policy-installed kiosk web apps and policy-installed Isolated Web Apps, both only on managed ChromeOS devices.

concepts

  1. Device Attributes Policy

    Permissions Policy gating for the Device Attributes API. Important for kiosk/IWA contexts where embedded third parties shouldn't see device identity.

  2. IWA Kiosk Config

    The VDI-from-Chrome-Apps motivation. Toggle the policy declaration and see the navigator.managed.* return values for top-level vs. iframe contexts.

  3. Header Explorer

    Toggle origins, watch the Permissions-Policy header rebuild, see which probe origins would be granted access. Useful when you're hand-authoring the IT admin's policy file.

  4. iframe Inheritance

    Combine a top-level header with an iframe allow attribute and see exactly which frames in a three-level tree still get access. The rule-set that 99% of policy bugs come from.

  5. Attribute Readout

    Live probe of the five device attributes a managed device surfaces — serial, asset ID, location, hostname, directory ID — with a button to simulate a deny policy.

why it shipped

The Device Attributes API allows web developers to query information about the device. This information can be used for context-based configuration or other device-aware use cases such as licensing.

references