I don't think the meta version of Permissions-Policy ever got implemented. "http-equiv" isn't a magic "here's a HTTP header I forgot to mention" pixie dust.

Better stick to the actual recommendation of adding the header in the server configuration.

Whilst http-equiv is said to be an enumerated value, so far as I know in Chrome, it actually is "magic HTTP Header pixie dust": [0]

And whilst in Firefox parsing of the element is more spread out, they accept a very wide number of headers that aren't documented, and you'll find examples on MDN for any number of headers using http-equiv which aren't specified in the standard or on their docs for http-equiv itself [2] (For example, X-DNS-Prefetch-Control [1]).

[0] https://source.chromium.org/chromium/chromium/src/+/master:o...

[1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-...

[2] https://developer.mozilla.org/en-US/docs/Web/HTML/Element/me...

In my case I don’t have access to the server configuration. I’m running a blog with Ghost Pro, is the above a reasonable workaround?

Hey, thanks for this! I've seen several posts now saying that all you need to do is add

``` Permissions-Policy: interest-cohort=()

```

somewhere, but they all seemed to assume that everyone knew where that where was (nginx config? webserver config? index.html? ??? ??????

When you see something along the lines of:

Foo: things

This will generally be a HTTP Header. How you add that depends on your server/framework. (And will be well documented).

If you've only got a static site, then you can always fallback and use HTML to achieve the same thing with http-equiv, which gets added to the head element:

    <meta http-equiv="Foo" content="things" />

For example to redirect to /foo after 3 seconds:

    <meta http-equiv="Refresh" content="3; /foo" />

It's a little off the beaten track for most people, but the kind of knowledge a web developer can be expected to know, or know where to look in the documentation.

Hopefully that can help you in your future endeavours.

It's an HTTP header, so follow the documentation for your tooling for how to add custom HTTP headers.