permissions-policy

edit

WPT coverage of the tests of permissions-policy at the revision 5602b0f210e3. The tests link to their results in the browsers on wpt.fyi. The tentative tests (experimental features) and the reftests are listed separately from the stable tests.

GroupPassingTestsDisabledPass rate
Stable4394046%
Tentative1423061%
Reftests0100%
All57118048%

Failure reasons

The tests that do not pass (failing or disabled), by kind of reason. A test with several reasons counts once per kind.

  • BUG: 1
  • TEST BUG: 10
  • NOT IMPLEMENTED: 49
  • TEST RUNNER: 1

Stable tests

TestResultSubtestsKindDescription
bluetooth-allowed-by-permissions-policy-attribute-redirect-on-load.https.sub.htmlError0 / 0NOT IMPLEMENTEDWeb Bluetooth (navigator.bluetooth; the helper /bluetooth/resources/bluetooth-test.js is not fetched)
bluetooth-allowed-by-permissions-policy-attribute.https.sub.htmlError0 / 0NOT IMPLEMENTEDWeb Bluetooth (navigator.bluetooth; the helper /bluetooth/resources/bluetooth-test.js is not fetched)
bluetooth-allowed-by-permissions-policy.https.sub.htmlError0 / 0NOT IMPLEMENTEDWeb Bluetooth (navigator.bluetooth; the helper /bluetooth/resources/bluetooth-test.js is not fetched)
bluetooth-default-permissions-policy.https.sub.htmlError0 / 0NOT IMPLEMENTEDWeb Bluetooth (navigator.bluetooth; the helper /bluetooth/resources/bluetooth-test.js is not fetched)
bluetooth-disabled-by-permissions-policy.https.sub.htmlError0 / 0NOT IMPLEMENTEDWeb Bluetooth (navigator.bluetooth; the helper /bluetooth/resources/bluetooth-test.js is not fetched)
experimental-features/focus-without-user-activation-default-permissions-policy.https.sub.htmlFail1 / 2TEST BUGthe test expects the default allowlist * for focus-without-user-activation (a cross-origin iframe is allowed); HTML defines 'self' (https://html.spec.whatwg.org/multipage/infrastructure.html#policy-controlled-features); fails in every browser
experimental-features/focus-without-user-activation-disabled-by-permissions-policy-cross-origin.https.sub.htmlPass1 / 1
experimental-features/focus-without-user-activation-disabled-by-permissions-policy.https.sub.htmlPass1 / 1
experimental-features/focus-without-user-activation-disabled.htmlPass1 / 1
experimental-features/focus-without-user-activation-enabled.sub.htmlPass1 / 1
experimental-features/focus-without-user-activation-focused-frame-descendant-cross-origin.https.sub.htmlFail1 / 2TEST BUGthe test expects the focused-frame heuristics of an experimental implementation of Chromium (a frame that has the focus, or an ancestor of the focused frame, may move the focus although its focus-without-user-activation policy is denied, and the policy of the document that calls focus() is checked instead of the one of the target); the allow focus steps of HTML only check the policy and the transient activation of the document of the target (https://html.spec.whatwg.org/multipage/interaction.html#allow-focus-steps). The stable browsers do not enforce the policy at all: the subtests that expect a focus to be blocked fail in them
experimental-features/focus-without-user-activation-focused-frame-descendant-remote.https.sub.htmlFail0 / 1TEST BUGthe test expects the focused-frame heuristics of an experimental implementation of Chromium (a frame that has the focus, or an ancestor of the focused frame, may move the focus although its focus-without-user-activation policy is denied, and the policy of the document that calls focus() is checked instead of the one of the target); the allow focus steps of HTML only check the policy and the transient activation of the document of the target (https://html.spec.whatwg.org/multipage/interaction.html#allow-focus-steps). The stable browsers do not enforce the policy at all: the subtests that expect a focus to be blocked fail in them
experimental-features/focus-without-user-activation-focused-frame-descendant.htmlFail3 / 7TEST BUGthe test expects the focused-frame heuristics of an experimental implementation of Chromium (a frame that has the focus, or an ancestor of the focused frame, may move the focus although its focus-without-user-activation policy is denied, and the policy of the document that calls focus() is checked instead of the one of the target); the allow focus steps of HTML only check the policy and the transient activation of the document of the target (https://html.spec.whatwg.org/multipage/interaction.html#allow-focus-steps). The stable browsers do not enforce the policy at all: the subtests that expect a focus to be blocked fail in them
experimental-features/focus-without-user-activation-setter-policy.htmlFail0 / 2TEST BUGthe test expects the focused-frame heuristics of an experimental implementation of Chromium (a frame that has the focus, or an ancestor of the focused frame, may move the focus although its focus-without-user-activation policy is denied, and the policy of the document that calls focus() is checked instead of the one of the target); the allow focus steps of HTML only check the policy and the transient activation of the document of the target (https://html.spec.whatwg.org/multipage/interaction.html#allow-focus-steps). The stable browsers do not enforce the policy at all: the subtests that expect a focus to be blocked fail in them
experimental-features/focus-without-user-activation-target-frame-state-ignored.htmlFail1 / 2TEST RUNNERtest_driver.click() on an iframe element does not give a transient activation to the window of the iframe, so the sanity check of the first subtest fails (the second subtest passes)
experimental-features/permissions-policy-header-host-wildcard.https.sub.htmlPass1 / 1
experimental-features/permissions-policy-header-port-wildcard.https.sub.htmlPass1 / 1
experimental-features/permissions-policy-header-scheme-only.https.sub.htmlPass1 / 1
historical-feature-policy-header.htmlPass1 / 1
historical.htmlPass4 / 4
idlharness.window.jsPass44 / 44
navigate-to-blob.sub.htmlPass2 / 2
payment-allowed-by-permissions-policy-attribute-redirect-on-load.https.sub.htmlFail1 / 2NOT IMPLEMENTEDthe Payment Request API (PaymentRequest); payment-extension-... also needs Web Authentication and test_driver.add_virtual_authenticator()
payment-allowed-by-permissions-policy-attribute.https.sub.htmlFail0 / 3NOT IMPLEMENTEDthe Payment Request API (PaymentRequest); payment-extension-... also needs Web Authentication and test_driver.add_virtual_authenticator()
payment-allowed-by-permissions-policy.https.sub.htmlFail1 / 4NOT IMPLEMENTEDthe Payment Request API (PaymentRequest); payment-extension-... also needs Web Authentication and test_driver.add_virtual_authenticator()
payment-default-permissions-policy.https.sub.htmlFail1 / 3NOT IMPLEMENTEDthe Payment Request API (PaymentRequest); payment-extension-... also needs Web Authentication and test_driver.add_virtual_authenticator()
payment-disabled-by-permissions-policy.https.sub.htmlFail2 / 3NOT IMPLEMENTEDthe Payment Request API (PaymentRequest); payment-extension-... also needs Web Authentication and test_driver.add_virtual_authenticator()
payment-extension-allowed-by-permissions-policy-attribute.https.sub.htmlTimeout0 / 2NOT IMPLEMENTEDthe Payment Request API (PaymentRequest); payment-extension-... also needs Web Authentication and test_driver.add_virtual_authenticator()
permissions-policy-frame-policy-allowed-for-all.https.sub.htmlPass78 / 78
permissions-policy-frame-policy-allowed-for-self.https.sub.htmlPass86 / 86
permissions-policy-frame-policy-allowed-for-some-override.https.sub.htmlPass32 / 32
permissions-policy-frame-policy-allowed-for-some.https.sub.htmlPass76 / 76
permissions-policy-frame-policy-disallowed-for-all.https.sub.htmlPass78 / 78
permissions-policy-frame-policy-timing.https.sub.htmlFail0 / 2NOT IMPLEMENTEDMedia Capture and Streams: the iframes report the state of the camera feature with navigator.mediaDevices.getUserMedia()
permissions-policy-header-policy-allowed-for-all.https.sub.htmlPass7 / 7
permissions-policy-header-policy-allowed-for-malformed-wildcard.https.sub.htmlPass7 / 7
permissions-policy-header-policy-allowed-for-self.https.sub.htmlPass5 / 5
permissions-policy-header-policy-allowed-for-some.https.sub.htmlPass10 / 10
permissions-policy-header-policy-allowed-for-wildcard.https.sub.htmlPass9 / 9
permissions-policy-header-policy-declined.https.sub.htmlFail9 / 10TEST BUGthe test expects getAllowlistForFeature() to return the declared origins although the feature is not allowed for the origin of the document (the header does not list self); the method returns an empty list in that case (https://w3c.github.io/webappsec-permissions-policy/#dom-permissionspolicy-getallowlistforfeature, step 4); the other subtests pass
permissions-policy-header-policy-disallowed-for-all.https.sub.htmlPass5 / 5
permissions-policy-javascript-url-frame-policy.https.htmlPass2 / 2
permissions-policy-nested-header-policy-allowed-for-all.https.sub.htmlPass6 / 6
permissions-policy-nested-header-policy-allowed-for-self.https.sub.htmlPass6 / 6
permissions-policy-nested-header-policy-disallowed-for-all.https.sub.htmlPass6 / 6
permissions-policy-nested-local-frame-delegation.https.sub.htmlPass3 / 3
permissions-policy-opaque-origin-history.https.htmlPass1 / 1
permissions-policy-opaque-origin.https.htmlFail0 / 1BUGthe 'src' keyword of the allow attribute of a sandboxed iframe matches every opaque origin, as in Chromium (where the test fails too): the document that the iframe navigates to still gets the feature, although it is not the document of the src attribute
picture-in-picture-allowed-by-permissions-policy-attribute-redirect-on-load.https.sub.htmlFail0 / 2NOT IMPLEMENTEDthe Picture-in-Picture API (document.pictureInPictureEnabled, requestPictureInPicture())
picture-in-picture-allowed-by-permissions-policy-attribute.https.sub.htmlFail0 / 2NOT IMPLEMENTEDthe Picture-in-Picture API (document.pictureInPictureEnabled, requestPictureInPicture())
picture-in-picture-allowed-by-permissions-policy.https.sub.htmlFail0 / 3NOT IMPLEMENTEDthe Picture-in-Picture API (document.pictureInPictureEnabled, requestPictureInPicture())
picture-in-picture-default-permissions-policy.https.sub.htmlFail0 / 3NOT IMPLEMENTEDthe Picture-in-Picture API (document.pictureInPictureEnabled, requestPictureInPicture())
picture-in-picture-disabled-by-permissions-policy.https.sub.htmlFail0 / 3NOT IMPLEMENTEDthe Picture-in-Picture API (document.pictureInPictureEnabled, requestPictureInPicture())
picture-in-picture-supported-by-permissions-policy.htmlPass1 / 1
policy-extends-to-data-url-all.htmlPass1 / 1
policy-extends-to-sandbox-all.htmlPass1 / 1
policy-extends-to-sandbox.htmlPass1 / 1
reporting/bluetooth-report-only.https.htmlError0 / 0NOT IMPLEMENTEDWeb Bluetooth (navigator.bluetooth; the helper /bluetooth/resources/bluetooth-test.js is not fetched)
reporting/bluetooth-reporting.https.htmlError0 / 0NOT IMPLEMENTEDWeb Bluetooth (navigator.bluetooth; the helper /bluetooth/resources/bluetooth-test.js is not fetched)
reporting/camera-potential-report-only.https.htmlPass1 / 1
reporting/camera-potential-reporting.https.htmlPass1 / 1
reporting/camera-report-only.https.htmlFail0 / 1NOT IMPLEMENTEDMedia Capture and Streams: the test uses the camera/microphone features with navigator.mediaDevices.getUserMedia() (and /mediacapture-streams/permission-helper.js, which is not fetched); the reports of the features that the library implements are tested by reporting/sync-xhr-report-only.html
reporting/camera-reporting.https.htmlError0 / 1NOT IMPLEMENTEDMedia Capture and Streams: the test uses the camera/microphone features with navigator.mediaDevices.getUserMedia() (and /mediacapture-streams/permission-helper.js, which is not fetched); the reports of the features that the library implements are tested by reporting/sync-xhr-report-only.html
reporting/encrypted-media-report-only.https.htmlFail0 / 1NOT IMPLEMENTEDEncrypted Media Extensions (navigator.requestMediaKeySystemAccess())
reporting/encrypted-media-reporting.https.htmlFail0 / 1NOT IMPLEMENTEDEncrypted Media Extensions (navigator.requestMediaKeySystemAccess())
reporting/fullscreen-report-only.htmlPass1 / 1
reporting/fullscreen-reporting.htmlPass1 / 1
reporting/generic-sensor-report-only.https.htmlPass1 / 1
reporting/generic-sensor-reporting.https.htmlPass1 / 1
reporting/geolocation-report-only.https.htmlFail0 / 1TEST BUGthe test expects a position but does not grant the geolocation permission (test_driver.set_permission()): the report is checked, then getCurrentPosition() fails with PERMISSION_DENIED
reporting/geolocation-reporting.https.htmlPass1 / 1
reporting/microphone-report-only.https.htmlFail0 / 1NOT IMPLEMENTEDMedia Capture and Streams: the test uses the camera/microphone features with navigator.mediaDevices.getUserMedia() (and /mediacapture-streams/permission-helper.js, which is not fetched); the reports of the features that the library implements are tested by reporting/sync-xhr-report-only.html
reporting/microphone-reporting.https.htmlError0 / 1NOT IMPLEMENTEDMedia Capture and Streams: the test uses the camera/microphone features with navigator.mediaDevices.getUserMedia() (and /mediacapture-streams/permission-helper.js, which is not fetched); the reports of the features that the library implements are tested by reporting/sync-xhr-report-only.html
reporting/midi-report-only.https.htmlTimeout0 / 1NOT IMPLEMENTEDthe Web MIDI API (navigator.requestMIDIAccess())
reporting/midi-reporting.https.htmlFail0 / 1NOT IMPLEMENTEDthe Web MIDI API (navigator.requestMIDIAccess())
reporting/payment-report-only.https.htmlTimeout0 / 1NOT IMPLEMENTEDthe Payment Request API (PaymentRequest)
reporting/payment-reporting.https.htmlFail0 / 1NOT IMPLEMENTEDthe Payment Request API (PaymentRequest)
reporting/picture-in-picture-report-only.htmlFail0 / 1NOT IMPLEMENTEDthe Picture-in-Picture API (document.pictureInPictureEnabled, requestPictureInPicture())
reporting/picture-in-picture-reporting.htmlFail0 / 1NOT IMPLEMENTEDthe Picture-in-Picture API (document.pictureInPictureEnabled, requestPictureInPicture())
reporting/report-only-and-enforce.https.sub.htmlFail0 / 1NOT IMPLEMENTEDMedia Capture and Streams: the test uses the camera/microphone features with navigator.mediaDevices.getUserMedia() (and /mediacapture-streams/permission-helper.js, which is not fetched); the reports of the features that the library implements are tested by reporting/sync-xhr-report-only.html
reporting/report-only-single-endpoint.https.sub.htmlFail0 / 1NOT IMPLEMENTEDMedia Capture and Streams: the test uses the camera/microphone features with navigator.mediaDevices.getUserMedia() (and /mediacapture-streams/permission-helper.js, which is not fetched); the reports of the features that the library implements are tested by reporting/sync-xhr-report-only.html
reporting/report-to-multiple-endpoints.https.sub.htmlFail0 / 1NOT IMPLEMENTEDMedia Capture and Streams: the test uses the camera/microphone features with navigator.mediaDevices.getUserMedia() (and /mediacapture-streams/permission-helper.js, which is not fetched); the reports of the features that the library implements are tested by reporting/sync-xhr-report-only.html
reporting/report-to-single-endpoint.https.sub.htmlFail0 / 1NOT IMPLEMENTEDMedia Capture and Streams: the test uses the camera/microphone features with navigator.mediaDevices.getUserMedia() (and /mediacapture-streams/permission-helper.js, which is not fetched); the reports of the features that the library implements are tested by reporting/sync-xhr-report-only.html
reporting/screen-wake-lock-reporting.https.htmlPass1 / 1
reporting/serial-report-only.https.htmlFail0 / 2NOT IMPLEMENTEDthe Web Serial API (navigator.serial)
reporting/serial-reporting.https.htmlFail0 / 2NOT IMPLEMENTEDthe Web Serial API (navigator.serial)
reporting/sync-xhr-report-only.htmlPass1 / 1
reporting/sync-xhr-reporting.htmlFail0 / 1TEST BUGthe report has the expected type, body and source location, then the test calls toJSON() on it: Report and the report bodies are dictionaries since w3c/reporting#284 (https://w3c.github.io/reporting/#dictdef-report), so the reports given to the observers are plain objects without toJSON() (the browsers still implement the former Report interface)
reporting/usb-report-only.https.htmlFail0 / 1NOT IMPLEMENTEDWebUSB (navigator.usb)
reporting/usb-reporting.https.htmlError0 / 1NOT IMPLEMENTEDWebUSB (navigator.usb)
reporting/xr-report-only.https.htmlFail0 / 1NOT IMPLEMENTEDthe WebXR Device API (navigator.xr)
reporting/xr-reporting.https.htmlFail0 / 1NOT IMPLEMENTEDthe WebXR Device API (navigator.xr)
speaker-selection-allowed-by-permissions-policy.https.sub.htmlPass4 / 4
speaker-selection-disabled-by-permissions-policy.https.sub.htmlPass3 / 3

Tentative tests

TestResultSubtestsKindDescription
experimental-features/focus-without-user-activation-click-handler.tentative.htmlFail0 / 2TEST BUGthe test reads the policy with the legacy document.featurePolicy (only document.permissionsPolicy is specified, and permissions-policy/historical.html checks that featurePolicy is not exposed); fails in every browser
experimental-features/focus-without-user-activation-label-click.tentative.htmlFail0 / 2TEST BUGthe test reads the policy with the legacy document.featurePolicy (only document.permissionsPolicy is specified, and permissions-policy/historical.html checks that featurePolicy is not exposed); fails in every browser
experimental-features/private-state-token-redemption-default-permissions-policy.tentative.https.sub.htmlFail0 / 4NOT IMPLEMENTEDPrivate State Tokens (the privateToken member of RequestInit): only the policy of the private-state-token-redemption feature is computed
experimental-features/private-state-token-redemption-supported-by-permissions-policy.tentative.htmlPass1 / 1
experimental-features/unload-allowed-by-default.tentative.window.jsPass1 / 1
experimental-features/unload-allowed-embed.tentative.window.jsPass1 / 1
experimental-features/unload-allowed-frameset.tentative.window.jsPass1 / 1
experimental-features/unload-allowed-headerless.tentative.window.jsPass4 / 4
experimental-features/unload-allowed-object.tentative.window.jsPass1 / 1
experimental-features/unload-disallowed-embed.tentative.window.jsPass1 / 1
experimental-features/unload-disallowed-frameset.tentative.window.jsPass1 / 1
experimental-features/unload-disallowed-headerless.tentative.window.jsPass4 / 4
experimental-features/unload-disallowed-object.tentative.window.jsPass1 / 1
experimental-features/unload-disallowed-subframe.tentative.window.jsPass1 / 1
experimental-features/unload-disallowed.tentative.window.jsPass1 / 1
experimental-features/vertical-scroll-scrollintoview.tentative.htmlFail1 / 2NOT IMPLEMENTEDthe vertical-scroll feature (an experimental policy of Chromium without specification): scrollIntoView() in the iframe scrolls the main frame; fails in every browser
payment-supported-by-permissions-policy.tentative.htmlPass1 / 1
private-state-token-issue-allowed-by-permissions-policy-attribute.tentative.https.sub.htmlFail0 / 2NOT IMPLEMENTEDPrivate State Tokens (the privateToken member of RequestInit): only the policy of the private-state-token-issuance feature is computed
private-state-token-issue-disabled-by-permissions-policy.tentative.https.sub.htmlFail0 / 5NOT IMPLEMENTEDPrivate State Tokens (the privateToken member of RequestInit): only the policy of the private-state-token-issuance feature is computed
private-state-token-issue-enabled-by-permissions-policy.tentative.https.sub.htmlFail0 / 4NOT IMPLEMENTEDPrivate State Tokens (the privateToken member of RequestInit): only the policy of the private-state-token-issuance feature is computed
private-state-token-issue-supported-by-permissions-policy.tentative.htmlPass1 / 1
shared-worker-permissions-policy-allow-option.https.tentative.htmlFail4 / 6NOT IMPLEMENTEDthe allow member of SharedWorkerOptions (a tentative proposal to delegate permissions policy features to a shared worker): the option is ignored, so a shared worker is created even when the creator cannot delegate the features
shared-worker-permissions-policy-connect.https.tentative.htmlFail2 / 4NOT IMPLEMENTEDthe allow member of SharedWorkerOptions (a tentative proposal to delegate permissions policy features to a shared worker): the option is ignored, so connecting to an existing shared worker with a different allow value succeeds instead of firing error

Reftests

TestResultVariantsKindDescription
experimental-features/vertical-scroll-disabled-scrollbar-tentative.htmlFail0 / 1NOT IMPLEMENTEDthe experimental vertical-scroll policy-controlled feature: the viewport of the iframe whose document is not allowed to scroll vertically (allow="vertical-scroll 'none'") still has its vertical scrollbar; no browser passes (the difference was not visible before the scrollbars were painted)