Overview

The battery directive controls availability of the Battery Status API accessed via navigator.getBattery(). That API exposes charging state, battery level, and charging/discharging time estimates, and its default allowlist is self.

Details

`battery=(self)` limits it to the document's own origin, `battery=()` blocks it entirely, and `battery=(self "https://app.example.com")` delegates to a named origin. An iframe needs `allow="battery"` to use it. When the policy denies the feature, the Promise returned by navigator.getBattery() rejects with a NotAllowedError.

Battery level and charging state, when observed across scripts, can serve as a fingerprinting vector for re-identifying users, which led several browsers to remove the Battery Status API entirely or to round and coarsen its values. So this directive narrows access to the feature where it still exists. It replaces the battery feature of the legacy Feature-Policy header.

Syntax

Permissions-Policy: battery=(self)

Notes

• Because of privacy concerns, browsers such as Firefox do not implement the Battery Status API, so always feature-detect before use.
• To reduce battery-based fingerprinting, block untrusted third-party frames with battery=().

Related directives