Registry / http-networking / feature-policy

feature-policy

JSON →
library0.6.0jsnpmunverified

This package, `feature-policy` (current stable version 0.6.0), provides Express/Connect middleware for setting the `Feature-Policy` HTTP header. This header allows web developers to selectively enable or disable browser features and APIs for a document or specific frames, helping to enhance security and user experience by preventing misuse of powerful features like geolocation or camera access. Key differentiators include its simple, object-based configuration API, which supports a wide array of browser features such as `fullscreen`, `vibrate`, `payment`, and `syncXhr`, making it easy to manage permissions. However, it is crucial for users to understand that the `Feature-Policy` header itself has been deprecated by browsers in favor of the more modern `Permissions-Policy`. Consequently, this module is now in maintenance mode, meaning it will continue to be supported for existing implementations but will not receive new features or updates to align with future browser developments. Its release cadence is effectively halted, focusing only on critical bug fixes to ensure stability for current users. Users are advised to consider migrating to `Permissions-Policy` for new projects or plan for eventual migration.

http-networkingauth-securityweb-framework
npm install feature-policy
github ↗package ↗
INSTALL
IMPORT
SIG · FEATURE-POLICY
F
feature-policy
http-networkingjavascriptv0.6.0
Install
—
Import
—
Disk
—
Pass rate
0/ 6
Env Coverage0 / 6
glibc
18–22
musl
18–22
Install & Compatibility
Where this runs
tested against v? · npm install
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
musl
node 18–226 runs
build_error
glibc
node 18–226 runs
build_error
Code
Verified usage

Verified import paths — ran on the pinned version, not inferred.

featurePolicy
✓ import featurePolicy from 'feature-policy';
✗ import { featurePolicy } from 'feature-policy';
This module uses a default export for the middleware function. For TypeScript, use `import featurePolicy from 'feature-policy';` to correctly import the function and its types.
featurePolicy
✓ const featurePolicy = require('feature-policy');
✗ const { featurePolicy } = require('feature-policy');
In CommonJS environments, the middleware function is the default export and is accessed directly from the `require` call.
FeaturePolicyOptions
✓ import type { FeaturePolicyOptions } from 'feature-policy';
Type import for configuring the middleware options, available since the package ships TypeScript types. Useful for strict type checking in TypeScript projects.

Demonstrates how to integrate and configure `feature-policy` middleware in an Express application to set browser feature permissions, applying a policy to all incoming requests.

const express = require('express'); const featurePolicy = require('feature-policy'); const app = express(); app.use( featurePolicy({ features: { fullscreen: ["'self'"], vibrate: ["'none'"], payment: ["example.com"], syncXhr: ["'none'"] } }) ); app.get('/', (req, res) => { res.send('Hello World! Check your response headers for Feature-Policy.'); }); const PORT = process.env.PORT ?? 3000; app.listen(PORT, () => { console.log(`Server listening on port ${PORT}`); });
Debug
Known issues
breakingThe `Feature-Policy` HTTP header, which this module sets, has been officially deprecated by all major browsers. It is being superseded by the `Permissions-Policy` header.
fix
Migrate to using `Permissions-Policy` headers directly or a module designed for `Permissions-Policy` to ensure future browser compatibility and security for new projects. This module should only be used for maintaining legacy systems.
affects: >=0.1.0
gotchaThis `feature-policy` module is currently in maintenance mode. No new features, updates to support new browser features, or general enhancements will be added, unless they are critical bug fixes.
fix
Evaluate the need for `feature-policy` in new projects carefully. For existing projects, plan for eventual migration to `Permissions-Policy` to avoid relying on a module with static support.
affects: >=0.6.0
gotchaIncorrectly configured `feature-policy` directives can unintentionally block legitimate browser features on your site (e.g., fullscreen mode, camera access), leading to a degraded user experience or broken functionality.
fix
Thoroughly test all policy configurations across different browsers and user flows. Start with strict policies and gradually relax them if necessary, meticulously observing browser console warnings/errors related to feature blocking.
affects: *
Errors
Common errors & fixes
TypeError: featurePolicy is not a function
Attempting to call the `feature-policy` module directly without passing configuration to its default exported function, or an incorrect import statement (e.g., named import for a default export).
fix
Ensure you are using `app.use(featurePolicy({...}));` in CommonJS or `import featurePolicy from 'feature-policy'; app.use(featurePolicy({...}));` in ESM, correctly invoking the module as a factory function with options.
Refused to execute '<feature-name>' because it violates the document's feature policy.
A browser feature (like 'fullscreen' or 'geolocation') is being blocked by a `Feature-Policy` directive that is too restrictive or misconfigured for the current context.
fix
Review the `features` configuration within your `featurePolicy` middleware. Ensure that necessary origins (e.e.g., `'self'`, `'none'`, or specific domain names) are correctly applied. Check the browser's developer console for more specific details about the blocked feature and the violated policy.
Upgrade
Version history
0.6.0latest on npm
Audit
Dependencies

No dependency data recorded yet.

Agent activity
15 hits · last 30 days
node
14
OpenAI (training)
1
Resources
githubhttps://github.com/helmetjs/feature-policy ↗
packagehttps://www.npmjs.com/package/feature-policy ↗
feature-policy — npm install feature-policy · libregistry