Permissions policy violation Browser Origin: On your device Last updated 15 Oct 2026

Console: [Violation] Permissions policy violation: camera is not allowed in this document (Feature-Policy)

A browser feature (camera, microphone, geolocation, fullscreen, payment…) was blocked by a Permissions-Policy header or an iframe that lacks the allow attribute.

Exact message you may see Permissions policy violation[Violation] Permissions policy violationis not allowed in this documentFeature policy violationPermissions-Policy header
Explore the map of this error Full error map →
Seen on: Chrome Edge Nginx Apache

Meaning

Servers can disable features for a whole page; embedding pages must grant them to iframes explicitly. The message names the feature. Fix by adding the feature to the allowed list in the header and, for iframes, to the allow attribute.

Common causes

  • Permissions-Policy: camera=() (or geolocation=()) blocks the feature for the whole page
  • Cross-origin iframe without allow="camera; microphone; fullscreen"
  • Parent page's policy denies the origin of the iframe
  • Old Feature-Policy header still set
  • Sandboxed iframe

⚡ Quick fix

  1. Allow the feature for your origin in the header, e.g. camera=(self)
  2. Add allow="camera; microphone" to the iframe element
  3. Remove conflicting old Feature-Policy headers

Detailed fix by platform

Nginx

  1. add_header Permissions-Policy "camera=(self), microphone=(self), geolocation=(self)" always;

Apache

  1. Header always set Permissions-Policy "camera=(self), microphone=(self)"

JavaScript

  1. <iframe src="https://meet.example.com" allow="camera; microphone; fullscreen"></iframe>

How to diagnose

  1. Feature — Which feature does the message name?
  2. Header — Response header on the page and its parents?
  3. Iframe — allow attribute present?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: On your device. Errors that are often confused with or caused by this one (click to open):

Aw, Snap! — Chrome: Aw, Snap! Something went wrong while displaying this webpage. Error code: STATUS_ACCESS_VIOLATION / SIGILL / Out of Memory (Browser)Aw, Snap!blocked a frame — SecurityError: Blocked a frame with origin "x" from accessing a cross-origin frame. (JavaScript)blocked a frameFailed to execute postMessage — Console: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://a.com') does not match the recipient window's origin ('https://b.com') (Browser)Failed to execute pos…Geolocation permission denied — Console: User denied Geolocation / Only secure origins are allowed (geolocation) / GeolocationPositionError code 1 (Browser)Geolocation permissio…HSTS — Chrome: You cannot visit example.com right now because the website uses HSTS (NET::ERR_CERT_… no bypass) (Browser)HSTSNotAllowedError: Permission denied — Console: NotAllowedError: Permission denied (getUserMedia — camera or microphone blocked) (Browser)NotAllowedError: Perm…Refused to display in a frame — Console: Refused to display 'https://…' in a frame because it set 'X-Frame-Options' to 'deny' / 'sameorigin' (Browser)Refused to display in…Permissio…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.