title: Geolocation denied for HTML embedded site - anchor tag feature policy
body: <p>The iframe with allow=&quot;geolocation&quot; works great.
  But what if I want to load a link which calls getCurrentPosition() from a html anchor tag?</p>
  <p>Example :
  In iframe, I'll use</p>
  <blockquote>
  <p><code>&lt;iframe src=&quot;https://siteWhichCallsGetGeolocation.com&quot; allow='geolocation'&gt;&lt;/iframe&gt;</code></p>
  </blockquote>
  <p>I have a use case where a html embed link like</p>
  <blockquote>
  <p><code>&lt;a href=&quot;https://siteWhichCallsGetGeolocation.com&quot;&gt;Click here to get geolocation&lt;/a&gt;</code></p>
  </blockquote>
  <p>is embedded in a parent site.
  The parent site loads the child link inside it's own iframe</p>
  <p>It is to be noted that The parent site's iframe has the allow=&quot;geolocation&quot; attribute .</p>
  <p>In this case the request is silently denied with error</p>
  <blockquote>
  <p>errorCode :1</p>
  </blockquote>
  <blockquote>
  <p>errorMessage: &quot;Geolocation has been disabled in this document by
  permissions policy.&quot;</p>
  </blockquote>
  <p>The <a href="https://dev.chromium.org/Home/chromium-security/deprecating-permissions-in-cross-origin-iframes" rel="nofollow noreferrer">feature policy</a> document point to iframe but what about anchor tag embeds?</p>
  <p>I understand that I can use a iframe instead of anchor tag embed but the parent site only allows anchor tag's.</p>
  <p>PS - This is my first question here. Please assist.</p>
  <p>Note :</p>
  <ol>
  <li>I also tried a random shot by including allow=&quot;geolocation&quot; for anchor tag, but it doesn't work.</li>
  <li>This seems to work on Safari (which I'm assuming is because Safari hasn't yet implemented feature policy for cross origin site requests)</li>
  </ol>
  <p><strong>Edit 1 :</strong></p>
  <p>I tried my use case in jsfiddle and notice that all scripts i give (iframe or anchor tag) are loaded inside jsfiddle's iframe</p>
  <p><code>&lt;iframe name=&quot;result&quot; allow=&quot;midi; geolocation; microphone; camera; display-capture; encrypted-media;&quot; sandbox=&quot;allow-modals allow-forms allow-scripts allow-same-origin allow-popups allow-top-navigation-by-user-activation allow-downloads&quot; allowfullscreen=&quot;&quot; allowpaymentrequest=&quot;&quot; frameborder=&quot;0&quot; src=&quot;&quot;&gt; &lt;/iframe&gt;</code></p>
  <p>If i load my iframe inside this, it works perfectly !(perfectly balanced, as all things should be...)</p>
  <p>But if I load my anchor tag inside this, i get the error. As per <a href="https://stackoverflow.com/a/67823435/6779404">granty's answer</a></p>
  <p>the jsfiddle's iframe  with allow='geolocation' should set jsfiddle site's feature policy that all scripts loaded inside that iframe can access geolocation right ? Why does my iframe inside jsfiddle's iframe work but anchor tag doesnt ?</p>
  <p>Note - I have no control over the top level site. I only code the scripts for <code>https://siteWhichCallsGetGeolocation.com</code></p>
  <p><strong>SOLUTION (if you have control over top document's feature policy or   control over any intermediate <code>&lt;iframe&gt;</code> which have geolocation permission)</strong> (derived from granty's answer)</p>
  <p>I tried the suggested solution by changing the jsfiddle's iframe attribute via inspect element to</p>
  <p><code>&lt;iframe name=&quot;result&quot; allow=&quot;midi; geolocation https://siteWhichCallsGetGeolocation.com ; microphone; camera; display-capture; encrypted-media;&quot; sandbox=&quot;allow-modals allow-forms allow-scripts allow-same-origin allow-popups allow-top-navigation-by-user-activation allow-downloads&quot; allowfullscreen=&quot;&quot; allowpaymentrequest=&quot;&quot; frameborder=&quot;0&quot;&gt;&lt;/iframe&gt;</code></p>
  <p>To highlight, I added my site next to geolocation in allowlist like</p>
  <blockquote>
  <p>allow=&quot;midi; <strong>geolocation <code>https://siteWhichCallsGetGeolocation.com</code></strong> ;</p>
  </blockquote>
  <p>and then loaded my anchor tag.
  When the getCurrentPosition() was triggered from script loaded from <code>https://siteWhichCallsGetGeolocation.com</code>, I got the browser prompt to Allow/Deny location sharing. I allowed and got the coordinates!</p>
  <p>Wow! If only it could be as simple as editing the top level document's feature/permissions policy via inspect element.</p>
  <p>But alas,I have no control over the top level document's feature policy. At least I understood what's going on under the hood.</p>