allowlist/'self'=], which means third-party contexts are not [=allowed

to use=] the API by default.

</p>

<p>

It is OPTIONAL for user agents to support

[[[PERMISSIONS-POLICY]]]'s `Permissions-Policy` HTTP header.

</p>

<p>

Developers can use the means afforded by the [[[permissions-policy]]]

specification to control if and when a third-party context is [=allowed

<p>

Although user agents are unified in preventing the Web Share API from

being used in third-party context, at the time of publication there

are interoperability with relying on the [[[Permissions-Policy]]] to

are interoperability issues with relying on the [[[Permissions-Policy]]] to

enable the API in third-party contexts. In particular, although

the[^iframe/allow^] attribute is widely supported, the updated syntax

for the [^iframe/allow^] attribute is not. Similarly, the

[[[Permissions-Policy]]] specification before relying on it to enable

the Web Share API in third-party contexts.

</p>

<p>

When the `Permissions-Policy` HTTP header is more widely supported,

the Working Group expects to revise this specification

to require support for the header.

</p>

</aside>

</section>

<section class="informative" id="a11y">