demo · v140

iframe Inheritance

Permissions Policy is delegated, not inherited blindly. Adjust the top-level header and per-frame allow attributes and the tree shows which frames still have access — the rules that 99% of policy bugs come from.

// Top-level (admin.example.com):
Permissions-Policy: device-attributes=(self "https://kiosk.example.com")

// Embedded iframe:
<iframe src="https://kiosk.example.com/sub" allow="device-attributes"></iframe>
// Without the allow attribute, the iframe gets device-attributes=() — deny.

see also