search

andrewlock / NetEscapades.AspNetCore.SecurityHeaders

Small package to allow adding security headers to ASP.NET Core websites
MIT License
701 stars 73 forks source link

Remove ambient-light-sensor=() Fix browser warning: Error with Permissions-Policy header: Unrecognized feature: 'ambient-light-sensor'. #203

Closed damienbod closed 1 month ago

damienbod commented 1 month ago

Fix browser warning for default PermissionPolicy

Error with Permissions-Policy header: Unrecognized feature: 'ambient-light-sensor'.

andrewlock commented 1 month ago

Hmmm 🤔 So, this directive is marked as experimental, but then so are 90% of the permission policy directives and it's a suggested directive by OWASP.

The main difference is that it's the only of those directives which are experimental in Chrome - most of them are missing from Firefox, and a couple of others are missing from Edge..

I feel like the browsers shouldn't be making this an error, it should just be informational - I should be able to over-specify permissions so that they apply once they are supported 😅

But fundamentally, this gives a bit of an issue 🤔 Should the default be only those that are supported everywhere? Because that's very few... Tying everything to Chrome's support feels... wrong 🤔

damienbod commented 1 month ago

This fixes the warning in Chrome, Edge and Brave, Firefox doesn't display the warnings, so I think it would be better.

Safari, I don't know, but this works with 3 of the main browsers.

andrewlock commented 1 month ago

meh, sold, thanks 😂