Hacker News Reader

Hacker News

Comment by imwillofficial | Hacker News Reader

Full thread

imwillofficial

Anyone have any idea how one might do this in a Ghost Blog? Outside of putting cloud flare in front?

View on HN

Put Nginx in front.

No.

Add the HTML equivalent to the document head:

    <meta http-equiv="Permissions-Policy" content="interest-cohort=()" />

Hey, thanks for this! I've seen several posts now saying that all you need to do is add

``` Permissions-Policy: interest-cohort=()

```

somewhere, but they all seemed to assume that everyone knew where that where was (nginx config? webserver config? index.html? ??? ??????

It's an HTTP header, so follow the documentation for your tooling for how to add custom HTTP headers.

When you see something along the lines of:

Foo: things

This will generally be a HTTP Header. How you add that depends on your server/framework. (And will be well documented).

If you've only got a static site, then you can always fallback and use HTML to achieve the same thing with http-equiv, which gets added to the head element:

    <meta http-equiv="Foo" content="things" />

For example to redirect to /foo after 3 seconds:

    <meta http-equiv="Refresh" content="3; /foo" />

It's a little off the beaten track for most people, but the kind of knowledge a web developer can be expected to know, or know where to look in the documentation.

Hopefully that can help you in your future endeavours.

I don't think the meta version of Permissions-Policy ever got implemented. "http-equiv" isn't a magic "here's a HTTP header I forgot to mention" pixie dust.

Better stick to the actual recommendation of adding the header in the server configuration.

In my case I don’t have access to the server configuration. I’m running a blog with Ghost Pro, is the above a reasonable workaround?

Whilst http-equiv is said to be an enumerated value, so far as I know in Chrome, it actually is "magic HTTP Header pixie dust": [0]

And whilst in Firefox parsing of the element is more spread out, they accept a very wide number of headers that aren't documented, and you'll find examples on MDN for any number of headers using http-equiv which aren't specified in the standard or on their docs for http-equiv itself [2] (For example, X-DNS-Prefetch-Control [1]).

[0] https://source.chromium.org/chromium/chromium/src/+/master:o...

[1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-...

[2] https://developer.mozilla.org/en-US/docs/Web/HTML/Element/me...

Reply on news.ycombinator.com