demo · v142

Permissions-Policy inheritance cascade

Permissions-Policy: identity-credentials-get follows the Permissions Policy cascade: if a parent denies the feature, no child iframe can re-enable it, even with an explicit allow attribute. Toggle the policy and allow attributes below to see the cascade in action and generate the exact header and attribute syntax.

Top frame (depth 0) response header
Permissions-Policy: identity-credentials-get
↳ embeds iframe (depth 1)
iframe (depth 1) ?
allow="identity-credentials-get"
↳ embeds nested iframe (depth 2)
nested iframe (depth 2) ?
allow="identity-credentials-get"

Top-frame response header


    

    

      
Iframe attributes

      

    

  


  
  

    
Permissions Policy cascade rules

    

      1.
      If the top-frame policy denies identity-credentials-get, all descendant frames are blocked — regardless of their allow attribute.
    

    

      2.
      If a parent iframe lacks the allow attribute, its children cannot be granted the feature either.
    

    

      3.
      If an iframe omits the allow attribute entirely, the feature is denied for that frame (default-deny for cross-origin embeds).
    

    

      4.
      To reach a nested iframe, every ancestor in the chain must explicitly delegate the feature via allow=.
    

  


  

    
see also