django-permissions-policy

What it is and what it does

django-permissions-policy is a Django middleware that injects the Permissions-Policy HTTP header into your application's responses, allowing you to declaratively restrict which browser capabilities (geolocation, camera, microphone, payment APIs, etc.) are available to scripts running on your pages. You configure it via a Django setting that maps feature names to lists of allowed origins, then the middleware automatically adds the header to every response. It also supports a report-only mode for testing policies before enforcement, and per-view decorator overrides for fine-grained control.

The package depends only on Django and asgiref, integrating cleanly into Django's middleware pipeline. It validates configuration at instantiation time to catch policy errors early, and supports both the enforced Permissions-Policy header and the non-enforcing Permissions-Policy-Report-Only header for gradual rollout. The middleware can be instantiated with explicit policy dictionaries for advanced use cases like dispatching between multiple policies within another middleware.

Use it for:

• Disable privacy-invasive features like geolocation and camera across your entire Django app by default.
• Allow autoplay only from your own origin and trusted third-party iframe sources.
• Test a restrictive permissions policy in report-only mode before enforcing it site-wide.
• Override the global policy on specific views that legitimately need camera or payment APIs.
• Enforce strict feature restrictions on public-facing pages while relaxing them on authenticated admin areas.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Sets the Permissions-Policy HTTP header on Django responses to control which browser features scripts and iframes can access.

Yes. The package is actively maintained, has no known vulnerabilities, integrates seamlessly into Django's middleware stack with low friction, and solves a real security/privacy concern with minimal configuration. Use it if you want to control browser feature access in your Django app.

Install

django-permissions-policy on PyPI

pip install django-permissions-policy

uv add django-permissions-policy

poetry add django-permissions-policy

Installing django-permissions-policy

Before you install

Low install friction with a pure Python wheel. Actively maintained with a recent release and straightforward middleware integration into Django's standard stack.

License in practice

MIT license permits unrestricted use, modification, and distribution in both open-source and proprietary projects.

Quickstart

# Install
python -m pip install django-permissions-policy

# In settings.py, add to MIDDLEWARE after SecurityMiddleware:
MIDDLEWARE = [
    "django.middleware.security.SecurityMiddleware",
    "django_permissions_policy.PermissionsPolicyMiddleware",
]

# Configure the policy:
PERMISSIONS_POLICY = {
    "geolocation": [],
    "camera": [],
    "microphone": [],
}

# In a view, optionally override:
from django_permissions_policy.decorators import permissions_policy_override

@permissions_policy_override({"camera": ["self"]})
def video_call_view(request):
    pass

Requires Django 5.2 to 6.1 and Python 3.10 to 3.15.

Verify before relying

• Whether the package validates against the full current W3C feature list or relies on browser-reported features
• Performance impact when processing responses with complex permission policies

Package facts

Evidence: django_permissions_policy-4.33.0-py3-none-any.whl

Keywords: Django

Tags

More Dynamic Content packages