Permissions Policy (Feature Policy) Header Regex for JavaScript

What this pattern does

This page provides a comprehensive, battle-tested regular expression for matching permissions policy (feature policy) header, ported and verified for JavaScript. In security-sensitive code, using an unverified regex can open the door to both false positives and denial-of-service attacks. The snippet below is ready to drop into your JavaScript project — whether you're validating in an Express middleware, a Next.js API route, or a client-side form.

Javascript Implementation

// Permissions Policy (Feature Policy) Header
// ReDoS-safe | RegexVault — Security > Security Headers

const permissionsPolicyFeaturePolicyHeaderRegex = /^(camera|microphone|geolocation|payment|usb|fullscreen|display-capture|gyroscope|accelerometer|magnetometer|ambient-light-sensor|autoplay|encrypted-media|midi|picture-in-picture|speaker-selection|sync-xhr|vibrate|web-share|clipboard-read|clipboard-write|interest-cohort|screen-wake-lock|xr-spatial-tracking)=\((\*|self(?:\s+"https?:\/\/[^"]+")*|)\)$/i;

function validatePermissionsPolicyFeaturePolicyHeader(input: string): boolean {
  return permissionsPolicyFeaturePolicyHeaderRegex.test(input);
}

// Example
console.log(validatePermissionsPolicyFeaturePolicyHeader("camera=()")); // true

Test Cases

When to use this pattern

This pattern is drawn from the Security > Security Headers category and carries a ReDoS-safe certification. That matters for JavaScript developers because especially critical in long-running Node.js event loops where a ReDoS vulnerability can block the entire process. RegexVault audits patterns against known backtracking attack vectors, ensuring you have the necessary context before using this regex in a high-stakes production environment.

Common Pitfalls

Technical Notes

Permissions Policy (formerly Feature Policy) controls which browser features are available to a page. camera=(), microphone=(), geolocation=() disables the feature completely. () = nobody, (self) = same origin only, (*) = all origins. Prevents third-party scripts from activating features.