The Permissions-Policy directive (formerly known as Feature-Policy) is a vital security tool that allows website owners to control which browser features and APIs can be accessed by their web pages and embedded content.

One of the lesser-known directives within Permissions-Policy is the "midi" directive, which governs access to the MIDI API (Musical Instrument Digital Interface). This API allows web applications to interact with MIDI devices, enabling the transmission of music-related data between the user’s device and the web application. While this functionality is useful for certain web-based musical applications, it also introduces privacy and security concerns if not properly controlled.

History and Origin of Permissions-Policy

The Permissions-Policy header was introduced by Google in 2018 under its original name, Feature-Policy, with the primary goal of providing developers with greater control over which browser features and APIs their websites could access. The need for this policy became evident as the web evolved into a platform that could access increasingly powerful device APIs, such as those handling sensors, hardware, and media devices. The introduction of these capabilities brought with it new security and privacy risks, especially as websites began embedding third-party content that could potentially misuse these features.

The midi directive was added to the Permissions-Policy to specifically manage access to the MIDI API, which allows websites to communicate with MIDI devices such as musical keyboards, synthesisers, and other external controllers. This API is used in web-based musical software, collaborative music tools, and digital instrument interfaces, but it also presents security and privacy risks. Improper access to this API could allow malicious websites or scripts to interact with connected MIDI devices without the user’s consent.

What Does the MIDI Directive Do?

The "midi" directive in the Permissions-Policy header allows website owners to control whether their site can access the MIDI API. This API is essential for applications that interact with musical devices, allowing for the exchange of MIDI messages between a browser and external MIDI hardware.

For example:

• Setting midi=() disables any access to the MIDI API, preventing both the website and any embedded third-party content from accessing MIDI devices connected to the user’s system.
• Setting midi=* enables full access to the MIDI API, allowing both the website and any embedded content to interact with MIDI devices.

This control is crucial because unrestricted access to the MIDI API could lead to unwanted interactions with connected devices, exposing users to potential privacy and security risks.

Why Was It Added?

The midi directive was introduced to address several key concerns associated with access to the MIDI API:

1. Preventing Unauthorised Access to MIDI Devices: MIDI devices are used to transmit sensitive musical and control data. Without restrictions, malicious websites or third-party content could access these devices without user consent, potentially causing unwanted interactions or data theft. The midi directive allows developers to control which parts of their site or embedded content can access these devices, preventing unauthorised use.

2. Protecting User Privacy: Although the data transmitted through MIDI devices is primarily related to musical notes and instrument control, there is still a privacy risk associated with unwanted access. Malicious scripts could exploit the MIDI API to collect information about the user’s connected devices or even attempt to use those devices for unintended purposes. The midi directive helps mitigate these risks by restricting unnecessary or untrusted access to the API.

3. Ensuring Secure Integration with Musical Software: Web applications that rely on the MIDI API for legitimate use, such as music production software or virtual instruments, need a secure way to interact with connected devices. The midi directive ensures that developers can manage which features or parts of the application are allowed to access the MIDI API, providing a secure environment for users who are interacting with musical devices online.

Use Cases It Guards Against

The midi directive is particularly useful in preventing several problematic use cases:

1. Unwanted Device Access: Without the midi directive, third-party scripts or embedded content could access MIDI devices connected to the user’s system, potentially causing unwanted interactions with musical equipment. This could lead to performance disruptions or even data theft if sensitive control signals are intercepted.

2. Device Misuse by Malicious Content: A compromised website or malicious third-party content could attempt to use the MIDI API to manipulate connected MIDI devices, such as altering settings on external instruments or software controllers. By restricting access through the midi directive, developers can prevent malicious actors from exploiting the MIDI API to interfere with connected devices.

3. Privacy Risks Related to Connected Devices: MIDI devices connected to a user’s system may contain identifying information or sensitive data about the user’s setup. Malicious websites could potentially gather this information if unrestricted access to the MIDI API is granted. By controlling access with the midi directive, developers can ensure that only trusted parts of the website can request permission to interact with connected MIDI devices.

4. Third-Party Content Abuse: Many websites embed third-party content such as advertisements, widgets, or social media integrations. These third-party scripts could potentially request access to the MIDI API, allowing them to interact with users’ devices in unintended ways. By setting the midi directive correctly, developers can prevent untrusted third-party content from accessing this sensitive API.

Why Should You Set Permissions-Policy MIDI Correctly?

There are several compelling reasons why website owners should ensure the midi directive is configured properly:

1. Protecting User Privacy and Device Security: MIDI devices are often used by musicians, producers, and hobbyists to create and control digital music. Unauthorised access to these devices could compromise privacy or interfere with a user’s workflow. By properly configuring the midi directive, website owners can ensure that only authorised and trusted applications have access to the user’s connected MIDI devices, protecting both privacy and device integrity.

2. Preventing Malicious Exploitation of MIDI Devices: Without strict controls, malicious websites or third-party content could exploit the MIDI API to manipulate connected devices, leading to data leaks or device disruptions. The midi directive ensures that access to these devices is restricted to legitimate use cases, reducing the risk of exploitation.

3. Maintaining Compliance with Privacy Regulations: With stringent privacy regulations like the GDPR in effect, website owners must ensure that personal data, including data transmitted through device APIs like MIDI, is handled appropriately. Mismanagement of device access could lead to privacy violations and legal penalties. By restricting MIDI API access, website owners can demonstrate compliance with data protection regulations and ensure user consent is obtained.

4. Building User Trust: Users who connect MIDI devices to a web-based application expect that their devices and data will be handled securely. Properly configuring the midi directive helps build trust with users, assuring them that their connected devices are safe from unauthorised access or misuse while using the website.

5. Reducing the Attack Surface: Following the principle of least privilege, website owners should only grant access to the APIs and features that are essential for their web applications to function. By restricting unnecessary access to the MIDI API, website owners can reduce the potential attack surface and prevent malicious actors from exploiting device APIs.

Conclusion: Securing Web-Based Music Applications with the MIDI Directive

The Permissions-Policy midi directive is a critical tool for managing access to the MIDI API, which allows websites to interact with connected musical devices. While this API is essential for web-based music production, instrument control, and collaborative applications, it also presents significant privacy and security risks if left unrestricted.

By configuring the midi directive correctly, website owners can prevent unauthorised access to connected MIDI devices, protect user privacy, and ensure compliance with data protection regulations. Whether the website is built for music professionals or hobbyists, setting the midi directive properly is an essential step towards building a secure and trustworthy web environment for users.