Permission API

Permission API
Name	Permission API
Developer	World Wide Web Consortium
Released	15 October 2015
Latest release version	1.0
Latest release date	19 October 2017
Programming language	JavaScript
Operating system	Cross-platform
Genre	Web API
License	W3C Software Notice and License
Website	https://www.w3.org/TR/permissions/

Permission API is a web API that provides a programmatic way to query the status of browser permissions granted to a web page, such as access to geolocation or the webcam. It allows developers to check if a permission has been granted, denied, or has not yet been prompted for, enabling more user-friendly interfaces and reducing unnecessary permission prompts. The specification is developed under the auspices of the World Wide Web Consortium and is designed to work alongside other modern web capabilities like the Push API and Service Workers.

Overview

The Permission API was introduced to address the fragmented and often intrusive nature of permission requests in early web applications, which could degrade the user experience. It provides a standardized, promise-based interface for querying permission states, allowing sites like Google Maps or Facebook to tailor their behavior before attempting to access sensitive devices. This API is part of a broader movement within the web standards community, championed by organizations like Mozilla Foundation and Google, to create a more powerful yet privacy-conscious web platform. Its development has been closely tied to advancements in secure contexts and the evolution of progressive web apps.

Browser Support

Implementation of the Permission API began with Chromium-based browsers like Google Chrome and Microsoft Edge, followed by adoption in Mozilla Firefox. As of recent versions, support is considered stable in these major browsers, while Safari and other browsers based on WebKit have been slower to implement the full specification. The legacy Internet Explorer browser from Microsoft does not support this API. The varying levels of support are tracked by resources like MDN Web Docs and Can I use, which are essential references for web developers working across different browser engines.

Permission Types

The API defines a set of permission names that correspond to powerful web features. Key types include `geolocation` for accessing the GPS, `notifications` for the Push API, `camera` and `microphone` for WebRTC communications, and `midi` for the Web MIDI API. Other permissions can cover access to ambient light sensor data, clipboard operations, or persistent storage. The list is extensible and designed to grow with the web platform, as seen with the integration of newer capabilities like the Payment Request API and Web Bluetooth.

API Usage

Developers use the `navigator.permissions.query()` method, which returns a Promise that resolves to a `PermissionStatus` object. This object contains a `state` property (e.g., `'granted'`, `'denied'`, `'prompt'`) and an `onchange` event handler. A common pattern is to check the state before calling a more specific API, such as `navigator.geolocation.getCurrentPosition()`, to avoid a redundant prompt. This pattern is employed by many major web services, including YouTube for camera access and Twitter for notification permissions, creating a smoother interaction flow.

Security and Privacy Considerations

The API operates strictly within secure contexts, requiring pages to be served over HTTPS to prevent malicious interception of permission states. It is a core component of the permissions policy (formerly Feature Policy) framework, which allows sites like The New York Times or BBC to control which origins can request certain permissions. The design explicitly avoids exposing a user's browsing history or cross-origin permission decisions, adhering to the privacy principles outlined by organizations like the Electronic Frontier Foundation. User agents like Brave may implement additional restrictions to align with their enhanced tracking protection models.

Comparison with Other APIs

Unlike the direct access models of older APIs like the Geolocation API, the Permission API is a meta-API for querying status, not for performing the operation itself. It complements the MediaDevices interface, which is used to actually access the camera or microphone. Compared to the Notifications API, which directly displays alerts, the Permission API checks for the right to do so. This separation of concerns is a design philosophy shared with other modern web standards, such as the Credential Management API and the Storage Access API, promoting modularity and user control across the World Wide Web.

Category:Web APIs Category:World Wide Web Consortium standards Category:JavaScript APIs