Inject Permissions Policy
Prevent unauthorized access to device features like cameras and microphones on third-party (embedded) websites.
Restrict device access on any web app—No integration needed
Web apps today can request access to powerful device features—like your camera, microphone, or even USB connections. While useful, this opens the door to abuse by malicious or compromised sites.
Webfuse lets you enforce strict permission policies on any web application—even if you don’t own it.
Add HTTP security headers dynamically using the Custom Headers App to block unauthorized device access, prevent XSS with CSP, or fully lock down web features—all within a secure Virtual Web Session.
Users Are Exposed to Invasive Permissions—Especially on Third-Party Apps
- Websites can silently request access to sensitive hardware
- Most users click “Allow” without understanding the risk
- Security teams can’t control permission behavior on apps they don’t own
- Existing solutions require complex reverse proxies or browser extensions
Webfuse puts the control back in your hands—at the session layer.
How Webfuse solves this
Dynamic Policy Injection—Applied in Real Time
Webfuse Spaces allow you to intercept and rewrite every response from a target web app. With the Custom Headers App, you can:
- Inject strict Permissions-Policy headers to block device access
- Add Content Security Policy (CSP) headers to prevent script injection
- Combine with Lockdown App for advanced protection against XSS, iframe abuse, and resource leakage
- Modify headers without altering the original app or server
Key benefits
- Block Camera, Mic, and Geolocation Access: Apply browser-native permission restrictions to any site
- No Server-Side Integration Needed: Apply headers from the session layer with Webfuse
- Stackable Security: Combine with CSP, Lockdown, and Session Monitoring for layered defense
Examples
- Audit & Restrict Vendor Portals that request unnecessary permissions
- Corporate Kiosk Browsing for sales reps or field agents—block all hardware access
- Embed External Apps in Sensitive Environments with enforced device security
Sign up & get started
Launch a secure session with device access restrictions in minutes. A template SPACE with the proper headers and Custom Headers App will be preinstalled—ready to lock down any target web app.
FAQ
Will this work on apps I don’t control or host?
Yes—Webfuse applies headers from the Virtual Web Session level, requiring no cooperation from the original host.
Can I use this to prevent access to Bluetooth or USB too?
Yes—Permissions-Policy supports a range of device features you can explicitly disable.
Can I combine multiple headers for defense-in-depth?
Absolutely. Use Permissions-Policy, Content-Security-Policy, X-Frame-Options, and more—stacked securely in your session.
