Registry / web-framework / django-permissions-policy

django-permissions-policy

library4.31.0pypypi✓ verified 86d ago

django-permissions-policy is a Django middleware that sets the Permissions-Policy HTTP header on your Django application. This header allows web developers to selectively enable or disable various browser features and APIs (e.g., camera, geolocation, autoplay) for the current document and any embedded iframes, enhancing security and privacy. The library, currently at version 4.29.0, is actively maintained with a regular release cadence.

web-framework auth-security

pip install django-permissions-policy

github ↗package ↗changelog ↗

INSTALL

IMPORT

SIG · DJANGO-PERMISSIONS

django-permissions-policy

web-frameworkpythonv4.31.0

Install

3.4s avg

Import

596ms

Disk

65MB

Pass rate

10/ 10

Env Coverage10 / 10

glibc

3.9–3.13

musl

3.9–3.13

Install & Compatibility

Where this runs

tested against v4.31.0 · pip install

no network on importno background threads

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

py 3.10–3.920 runs

installs and imports cleanly · install 0.0s · import 0.633s · 66.3MB

glibc

py 3.10–3.920 runs

installs and imports cleanly · install 3.4s · import 0.560s · 67MB

65MB installed

● package 65MB

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

PermissionsPolicyMiddleware

✓ from django_permissions_policy import PermissionsPolicyMiddleware

Add `PermissionsPolicyMiddleware` to your `MIDDLEWARE` setting, ideally after Django's `SecurityMiddleware`. Then, define your desired policy using the `PERMISSIONS_POLICY` dictionary in your `settings.py` file. You can also use `PERMISSIONS_POLICY_REPORT_ONLY` for testing policies without enforcing them.

# settings.py MIDDLEWARE = [ # ... "django.middleware.security.SecurityMiddleware", "django_permissions_policy.PermissionsPolicyMiddleware", # ... ] PERMISSIONS_POLICY = { "accelerometer": [], "ambient-light-sensor": [], "autoplay": [], "camera": [], "display-capture": [], "encrypted-media": [], "fullscreen": [], "geolocation": [], "gyroscope": [], "interest-cohort": [], "magnetometer": [], "microphone": [], "midi": [], "payment": [], "usb": [], } # Or for report-only mode: # PERMISSIONS_POLICY_REPORT_ONLY = { # "geolocation": ["self"], # "camera": [], # }

Debug

Known issues

breakingThe library was renamed from `django-feature-policy` to `django-permissions-policy` in version 4.0.0. The middleware class was renamed from `FeaturePolicyMiddleware` to `PermissionsPolicyMiddleware`, and the setting from `FEATURE_POLICY` to `PERMISSIONS_POLICY`. While old names are supported as aliases for backward compatibility, it's recommended to update to the new names.

fix

Update middleware path in `settings.py` to `django_permissions_policy.PermissionsPolicyMiddleware` and setting names to `PERMISSIONS_POLICY` or `PERMISSIONS_POLICY_REPORT_ONLY`.

affects: >=4.0.0

gotchaWhen specifying origins in your policy settings (e.g., for `PERMISSIONS_POLICY`), use Python strings like `'self'`, `'*'`, or `'https://example.com'`. Do not include double quotes around domain names, as the middleware automatically adds them for the HTTP header. For example, use `'https://example.com'` instead of `"https://example.com"`.

fix

Ensure policy values for origins are raw strings without extraneous quotes, e.g., `['self', 'https://example.com']`.

affects: All

gotchaTo entirely disallow a feature (no origins allowed), use an empty list `[]` as its value in the policy dictionary. The legacy value `'none'` is supported for backward compatibility but is ignored and should be replaced with `[]`.

fix

Replace `"feature-name": "none"` with `"feature-name": []`.

affects: All

gotchaIncorrect keys or values in `PERMISSIONS_POLICY` or `PERMISSIONS_POLICY_REPORT_ONLY` settings can raise an `ImproperlyConfigured` exception. Browsers may also log warnings for features they don't recognize; these can generally be ignored if the names are valid according to the W3C spec, as the library performs basic validation.

fix

Refer to the W3C spec or MDN for a full list of valid feature names and ensure correct origin syntax. Check Django logs for `ImproperlyConfigured` errors during startup.

affects: All

gotchaThe placement of `PermissionsPolicyMiddleware` within your `MIDDLEWARE` list in `settings.py` is crucial. It's recommended to place it after `django.middleware.security.SecurityMiddleware` to ensure it integrates correctly within Django's security stack.

fix

Verify that `django_permissions_policy.PermissionsPolicyMiddleware` is positioned correctly in your `MIDDLEWARE` list.

affects: All

Errors

Common errors & fixes

django.core.exceptions.ImproperlyConfigured

The PERMISSIONS_POLICY or PERMISSIONS_POLICY_REPORT_ONLY setting in your settings.py file contains invalid keys (unrecognized browser features) or invalid values (incorrect origin formats or types).

fix

Ensure that the keys in your PERMISSIONS_POLICY dictionary are valid browser feature names (e.g., 'camera', 'geolocation') and that values are lists of strings representing valid origins ('self', '*', or specific URLs like 'https://example.com').

ModuleNotFoundError: No module named 'django_permissions_policy'

The 'django-permissions-policy' package has not been installed in your current Python environment or is not accessible on the Python path.

fix

Install the package using pip: `python -m pip install django-permissions-policy`.

ModuleNotFoundError: No module named 'django_permissions_policy.PermissionsPolicyMiddleware'

The path to the `PermissionsPolicyMiddleware` in your `MIDDLEWARE` setting in `settings.py` is misspelled or incorrect.

fix

Correct the middleware path in `settings.py` to `django_permissions_policy.PermissionsPolicyMiddleware`.

Upgrade

Version history

4.31.0latest on PyPI · released Jun 12, 2026

Audit

Dependencies

DjangorequiredCore framework requirement for middleware integration.

PythonrequiredRuntime environment.

Agent activity

20 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/adamchainz/django-permissions-policy ↗

packagehttps://pypi.org/project/django-permissions-policy/ ↗

changeloghttps://github.com/adamchainz/django-permissions-policy/blob/main/CHANGELOG.rst ↗