Skip to content

Commit c959501

Browse files
committed
Update and clarify Permissions-Policy: bluetooth
1 parent 97939d4 commit c959501

File tree

1 file changed

+12
-13
lines changed
  • files/en-us/web/http/reference/headers/permissions-policy/bluetooth

1 file changed

+12
-13
lines changed

files/en-us/web/http/reference/headers/permissions-policy/bluetooth/index.md

Lines changed: 12 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -30,36 +30,35 @@ Permissions-Policy: bluetooth=<allowlist>;
3030

3131
## Default policy
3232

33-
The default allowlist for `bluetooth` is `self`.
33+
The default allowlist for `bluetooth` is `self`. The top-level browsing context and same-origin iframes are allowed access to the `bluetooth` feature by default.
3434

3535
## Examples
3636

37-
### General example
37+
### Basic usage
3838

39-
SecureCorp Inc. wants to disable the Web Bluetooth API within all browsing contexts except for its own origin and those whose origin is `https://example.com`.
40-
It can do so by delivering the following HTTP response header to define a Permissions Policy:
39+
SecureCorp Inc. wants to disallow `bluetooth` within all browsing contexts except for its own origin and those whose origin is `https://example.com`. It can do so by delivering the following HTTP response header to define a Permissions Policy:
4140

4241
```http
4342
Permissions-Policy: bluetooth=(self "https://example.com")
4443
```
4544

46-
### With an \<iframe> element
47-
48-
FastCorp Inc. wants to disable `bluetooth` for all cross-origin child frames, except for a specific `<iframe>`.
49-
It can do so by delivering the following HTTP response header to define a Permissions Policy:
45+
Then include an {{HTMLElement('iframe','allow','#Attributes')}} attribute on the `<iframe>` element:
5046

51-
```http
52-
Permissions-Policy: bluetooth=(self https://other.com/blue)
47+
```html
48+
<iframe src="https://example.com/blue" allow="bluetooth"></iframe>
5349
```
5450

55-
Then include an {{HTMLElement('iframe','allow','#Attributes')}} attribute on the `<iframe>` element:
51+
> [!NOTE]
52+
> Specifying the `Permissions-Policy` header in this manner disallows `bluetooth` for other origins, even if they would be allowed by the `<iframe>` `allow` attribute.
53+
54+
### Using the default policy
55+
56+
FastCorp Inc. wants to allow `bluetooth` in a specific cross-origin child frame. Since the default allowlist for `bluetooth` is `self`, it can do so by including an {{HTMLElement('iframe','allow','#Attributes')}} attribute on the `<iframe>` element:
5657

5758
```html
5859
<iframe src="https://other.com/blue" allow="bluetooth"></iframe>
5960
```
6061

61-
`<iframe>` attributes can selectively enable features in certain frames, and not in others, even if those frames contain documents from the same origin.
62-
6362
## Specifications
6463

6564
{{Specifications}}

0 commit comments

Comments
 (0)