id: deprecated-feature-policy

info:
  name: Deprecated Feature-Policy Header - Detection
  author: ritikchaddha
  severity: info
  description: |
    Detected the presence of the deprecated Feature-Policy HTTP response header. The Feature-Policy header has been deprecated and replaced by the Permissions-Policy header. While Feature-Policy is still supported in some browsers for backward compatibility, it is recommended to migrate to Permissions-Policy for future-proofing web applications.
  reference:
    - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy
    - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permissions-Policy
    - https://www.w3.org/TR/permissions-policy-1/
    - https://github.com/w3c/webappsec-permissions-policy/blob/main/permissions-policy-explainer.md
  metadata:
    verified: true
    max-request: 1
  tags: misc,headers,deprecated,feature-policy,permissions

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - "Feature-Policy:"
        case-insensitive: true

    extractors:
      - type: kval
        part: header
        kval:
          - feature_policy
# digest: 4b0a0048304602210081887af3f1c09f092e8a0a7d6050d3e3d702d9816033995e48906d6bc8a94d96022100a7636fa434590547bd8527be2e002a57b74eb00e49175c7e6f404ca2ac92c861:922c64590222798bb761d5b6d8e72950