# Console: [Violation] Permissions policy violation: camera is not allowed in this document (Feature-Policy)

**Code:** `Permissions policy violation` · **Category:** Browser · **Seen on:** Chrome, Edge, Nginx, Apache

A browser feature (camera, microphone, geolocation, fullscreen, payment…) was blocked by a `Permissions-Policy` header or an iframe that lacks the `allow` attribute.

## Meaning

Servers can disable features for a whole page; embedding pages must grant them to iframes explicitly. The message names the feature. Fix by adding the feature to the allowed list in the header and, for iframes, to the `allow` attribute.

## Common causes

- `Permissions-Policy: camera=()` (or `geolocation=()`) blocks the feature for the whole page
- Cross-origin iframe without `allow="camera; microphone; fullscreen"`
- Parent page's policy denies the origin of the iframe
- Old `Feature-Policy` header still set
- Sandboxed iframe

## Quick fix

1. Allow the feature for your origin in the header, e.g. `camera=(self)`
2. Add `allow="camera; microphone"` to the iframe element
3. Remove conflicting old `Feature-Policy` headers

## Detailed fix by platform

### Nginx

1. `add_header Permissions-Policy "camera=(self), microphone=(self), geolocation=(self)" always;`

### Apache

1. `Header always set Permissions-Policy "camera=(self), microphone=(self)"`

### JavaScript

1. `<iframe src="https://meet.example.com" allow="camera; microphone; fullscreen"></iframe>`

## How to diagnose

1. **Feature** — Which feature does the message name?
2. **Header** — Response header on the page and its parents?
3. **Iframe** — allow attribute present?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/browser/permissions-policy-violation)