allow

Overview

The allow attribute controls which browser APIs an embedded <iframe> can access. By default, most powerful features (camera, microphone, geolocation, payment) are blocked in iframes. The allow attribute explicitly grants permission for specific capabilities.

This is part of the Permissions Policy specification (formerly known as Feature Policy). It operates as an allowlist: only the features you name are enabled for the embedded content.

Applies to: <iframe>

Values

The attribute takes a semicolon-separated list of permission directives. Each directive is a feature name, optionally followed by an origin allowlist.

Origin Restrictions

By default, a directive grants the permission to the iframe's own origin. You can restrict it further by specifying an explicit origin after the directive name.

Syntax Patterns

Common Embed Patterns

Principle of Least Privilege

Only grant the permissions the embed actually needs. Copy-pasting a long allow string from an embed provider without understanding each directive is a security risk. Review each permission and remove those your embed does not require.

Relationship to sandbox

The sandbox attribute and allow serve different purposes:

• sandbox restricts broad capabilities: scripts, forms, navigation, popups, same-origin access
• allow controls specific browser APIs: camera, microphone, fullscreen, payment

They can be used together for defense in depth. The sandbox handles structural restrictions while allow gates individual API access.

Accessibility

• The allow attribute itself has no direct accessibility impact, but the features it gates do. For example, denying fullscreen on a video embed prevents users who rely on enlarged video from using fullscreen mode.
• Always include a title attribute on iframes. This is the primary way screen readers identify the iframe's purpose, regardless of permissions.
• If an embed requires camera or microphone access, ensure the surrounding page explains why before the user encounters the permission prompt.

Limitations

• The allow attribute only works on <iframe> elements. It has no effect on other embedded content like <object> or <embed>.
• Permissions granted via allow still require the user to approve the browser's permission prompt (for camera, microphone, geolocation, etc.). The attribute enables the prompt; it does not bypass consent.
• Some directives are not yet supported in all browsers. Check compatibility for newer permissions like clipboard-read and sensor APIs.
• Permissions cannot be granted at a more permissive level than the parent page. If the top-level page has denied camera via a Permissions-Policy HTTP header, no iframe can enable it.
• The older allowfullscreen and allowpaymentrequest boolean attributes still work but are superseded by the allow syntax. Prefer allow="fullscreen" over allowfullscreen.