--- title: What Is Widevine DRM? L1, L2 and L3 Explained description: What is Widevine DRM? Learn how Widevine L1, L2 and L3 protect streaming content and affect video quality and device security. image: https://blog.blazingcdn.com/hubfs/Gemini-Blog/image-Nov-01-2026-06-55-36-5559-AM.jpeg --- [![BlazingCDN](https://blog.blazingcdn.com/hubfs/Logo/blog-logo-w.png)](https://blog.blazingcdn.com?hsLang=en-us) [๐Ÿ“˜Learn โ–พ](https://blog.blazingcdn.com/cdn-learn?hsLang=en-us) [CDN Fundamentals](https://blog.blazingcdn.com/cdn-fundamentals?hsLang=en-us) [By Content Type](https://blog.blazingcdn.com/by-content-type?hsLang=en-us) [Advanced Concepts](https://blog.blazingcdn.com/advanced-concepts?hsLang=en-us) [Glossary](https://blog.blazingcdn.com/glossary?hsLang=en-us) [โšก Web Performance](https://blog.blazingcdn.com/web-performance?hsLang=en-us) [๐ŸŽฌVideo & Streaming โ–พ](https://blog.blazingcdn.com/video-streaming-cdn?hsLang=en-us) [๐Ÿ”ด Live Streaming](https://blog.blazingcdn.com/live-streaming?hsLang=en-us) [๐Ÿ“บ VOD & OTT](https://blog.blazingcdn.com/vod-ott?hsLang=en-us) [๐Ÿ’ฐ Bandwidth & Costs](https://blog.blazingcdn.com/bandwidth-costs?hsLang=en-us) [๐Ÿญ Other Industries โ–พ](https://blog.blazingcdn.com/cdn-industry-insights?hsLang=en-us) [๐Ÿ“บ Media & Broadcasting](https://blog.blazingcdn.com/media-broadcasting?hsLang=en-us) [๐Ÿ’พ Software & SaaS](https://blog.blazingcdn.com/software-saas?hsLang=en-us) [๐Ÿ—๏ธ DevOps & Cloud Infra](https://blog.blazingcdn.com/devops-cloud-infra?hsLang=en-us) [๐Ÿ“š AdTech & Advertising](https://blog.blazingcdn.com/adtech-advertising?hsLang=en-us) [๐ŸŽฎ Gaming & Esports](https://blog.blazingcdn.com/gaming-esports?hsLang=en-us) [๐Ÿ“ฑ Mobile Apps & Developers](https://blog.blazingcdn.com/mobile-apps-developers?hsLang=en-us) [๐Ÿค– AI & Machine Learning](https://blog.blazingcdn.com/ai-machine-learning?hsLang=en-us) [๐Ÿ›๏ธ Enterprise & Corporate](https://blog.blazingcdn.com/enterprise-corporate?hsLang=en-us) [๐Ÿ“š E-Learning & EdTech](https://blog.blazingcdn.com/e-learning-edtech?hsLang=en-us) [๐ŸŸ๏ธ Sports & Live Events](https://blog.blazingcdn.com/sports-live-events?hsLang=en-us) [๐Ÿ’ฐ Pricing & Costs โ–พ](https://blog.blazingcdn.com/cdn-pricing-and-cdn-costs?hsLang=en-us) [Provider Pricing](https://blog.blazingcdn.com/provider-pricing?hsLang=en-us) [Cost Optimization](https://blog.blazingcdn.com/cost-optimization?hsLang=en-us) [Decision Support](https://blog.blazingcdn.com/decision-support?hsLang=en-us) [โšกCompare โ–พ](https://blog.blazingcdn.com/cdn-comparison?hsLang=en-us) [Provider Comparisons](https://blog.blazingcdn.com/provider-comparisons?hsLang=en-us) [Strategy Comparisons](https://blog.blazingcdn.com/strategy-comparisons?hsLang=en-us) [Ratings & Benchmarks](https://blog.blazingcdn.com/cdn-ratings-and-benchmarks?hsLang=en-us) [๐Ÿ“Š Benchmarks](https://blog.blazingcdn.com/cdn-ratings-and-benchmarks?hsLang=en-us) [๐Ÿ”’ Security โ–พ](https://blog.blazingcdn.com/cdn-security?hsLang=en-us) [Attack Protection](https://blog.blazingcdn.com/attack-protection?hsLang=en-us) [Encryption & Access](https://blog.blazingcdn.com/encryption-access?hsLang=en-us) [Video & DRM Security](https://blog.blazingcdn.com/video-drm-security?hsLang=en-us) [๐Ÿ“ Case Studies](https://blog.blazingcdn.com/case-studies?hsLang=en-us) [๐Ÿ”Œ Integrations](https://blog.blazingcdn.com/integrations?hsLang=en-us) [๐Ÿ› ๏ธ Tools](https://blog.blazingcdn.com/cdn-tools?hsLang=en-us) [Get Started](https://blazingcdn.com/sign-up-contact-form/) [Learn](https://blog.blazingcdn.com/en-us/tag/learn) [Security](https://blog.blazingcdn.com/en-us/tag/security) [Security - Video & DRM Security](https://blog.blazingcdn.com/en-us/tag/security-video-drm-security) # What Is Widevine DRM? L1, L2 and L3 Explained Vadym Borovskyi Nov 1, 2026, 7:57:36โ€ฏAM ![](https://blog.blazingcdn.com/hubfs/Gemini-Blog/image-Nov-01-2026-06-55-36-5559-AM.jpeg) Engineers asking what is Widevine usually need one fact first. Widevine is Google's digital rights management (DRM) system: built into Chrome, Firefox, Android, Android TV, ChromeOS and many smart TVs, it decrypts Common Encryption (CENC) video only after a license server releases content keys to a trusted Content Decryption Module (CDM). How far a service trusts that CDM depends on one of three security levels: L1, L2 or L3. As of 2026, Widevine DRM defines three security levels. L1 decrypts and decodes inside a hardware Trusted Execution Environment (TEE), L2 decrypts in the TEE but decodes outside it, and L3 runs entirely in software. Premium streaming services typically cap Widevine L3 playback at 480p to 720p and reserve 1080p and 4K for L1 devices with HDCP 2.2 output protection. ## **How the Widevine DRM License Flow Works** A Widevine playback session is a key exchange wrapped around ordinary segment delivery. The video bytes are encrypted once at packaging time. Each device then proves its identity and security level to a license server, which decides which content keys that device may receive. 1. **Packaging.** The packager encrypts samples with AES-128 keys using the CENC scheme (AES-CTR) or the cbcs scheme (AES-CBC with a 1:9 pattern), per ISO/IEC 23001-7. Key IDs and a Protection System Specific Header (PSSH) box carrying the Widevine system ID edef8ba9-79d6-4ace-a3c8-27dcd51d21ed go into the init segment, the DASH manifest's ContentProtection element, or both. 2. **Key system access.** The player reads the PSSH and calls the Encrypted Media Extensions (EME) method requestMediaKeySystemAccess for the key system com.widevine.alpha. It requests a robustness level such as SW\_SECURE\_CRYPTO or HW\_SECURE\_ALL. 3. **License request.** The CDM generates an opaque request that is signed with the device certificate it received during provisioning. That signature is how the server learns the true security level. 4. **Authorization.** The app sends the request to the service's license proxy, which checks entitlement and forwards it to the Widevine license service or a multi-DRM provider. The response carries content keys encrypted to that device, plus a policy: license duration, renewal interval, HDCP requirement and minimum security level per key. 5. **Decryption.** The CDM loads the keys and decrypts samples. On L1, the clear frames stay in secure memory on their way to the display. Timing matters for startup. The license round trip sits on the critical path before the first frame. Our estimate is 100 to 300 ms depending on proxy location and backend checks, which is why players prefetch licenses during the manifest fetch. Live services also schedule renewals (heartbeats), and Android supports persistent licenses for offline downloads. ## **Widevine L1, L2 and L3 Security Levels Compared** ### What does Widevine L1 mean? Widevine L1 means cryptography, video decoding and frame handling all run inside a hardware TEE, typically ARM TrustZone with a secure decoder path. Decrypted frames are never exposed to the operating system. L1 is what studios require for 1080p, 4K and HDR, usually combined with HDCP 2.2 on any external display link. L1 is a property of the device: SoC, firmware and factory-provisioned credentials together. It is not a property of the app. That is why an Android phone loses L1 and drops to L3 when its bootloader is unlocked, or when its keybox is revoked after a leak. ### Why is Widevine L3 limited to SD on most services? Widevine L3 is limited because it runs the whole CDM in software, protected only by obfuscation. Its keys can be extracted with enough effort, and public L3 extractions have demonstrated this. Content owners therefore accept L3 for SD, roughly 480p to 540p on mobile and up to 720p in desktop browsers, but rarely above. Desktop Chrome on Windows, macOS and Linux runs L3. Services that want 4K in Windows browsers usually rely on PlayReady SL3000 in Microsoft Edge, not on Widevine. ### Where does L2 fit? L2 performs cryptography inside the TEE but decodes video in normal memory. It is uncommon in shipping devices, and most license policies treat it like L3 for content gating. ## **What Is Widevine Responsible For in the Delivery Stack?** Widevine owns key exchange and decryption, nothing else. The manifest, the encrypted CMAF or fMP4 segments and the init segments are identical for every viewer, so they cache like any static object. Only the license request is per-session, uncacheable POST traffic that has to reach your proxy. That split shapes the architecture. Segment delivery scales on the CDN, while the license proxy needs its own capacity planning for startup spikes. A delivery layer such as the [**BlazingCDN HLS Streaming CDN for pre-encoded HLS, LL-HLS and DASH**](https://blazingcdn.com/streaming-cdn/) serves the encrypted segments, and its signed URLs and tokens restrict who can fetch them. Widevine then controls who can decrypt them. ## **Key-per-Tier Matrix for Widevine L1 and L3 Enforcement** Security levels only protect anything if the keys are split by rendition tier. If one key encrypts every rendition, an L3 device that is legitimately granted that key for SD can decrypt the 4K track too. The matrix below is a common policy shape for premium catalogs. | Content tier | Renditions | Minimum Widevine level | EME robustness | Output protection | | --- | --- | --- | --- | --- | | Audio (own key) | AAC, AC-3 | L3 | SW\_SECURE\_CRYPTO | None | | SD (own key) | Up to 576p | L3 | SW\_SECURE\_DECODE | None or HDCP 1.4 | | HD (own key) | 720p to 1080p | L1 | HW\_SECURE\_DECODE | HDCP 1.4 | | UHD / HDR (own key) | 1440p to 2160p | L1 | HW\_SECURE\_ALL | HDCP 2.2 | Security levels are enforced per key, so a catalog encrypted with a single key gives an L3 client access to every rendition it is licensed for at all. On the client, two checks confirm the matrix works. On Android, MediaDrm's getPropertyString with the argument "securityLevel" returns L1 or L3, and the player should filter out renditions the device cannot decrypt before adaptive bitrate selection starts. In browsers, pass audioCapabilities and videoCapabilities with explicit robustness values to requestMediaKeySystemAccess. Then confirm in the license server logs that HD keys are withheld from L3 requests instead of failing at decode time. ## **Widevine vs. PlayReady, FairPlay and AES-128** **Widevine vs. PlayReady:** PlayReady is Microsoft's DRM, used in Edge, Windows apps, Xbox and many smart TVs. Its SL2000 and SL3000 levels roughly mirror Widevine L3 and L1. Both read the same CENC-encrypted assets with separate PSSH boxes. **Widevine vs. FairPlay:** FairPlay Streaming is Apple's DRM for Safari, iOS, iPadOS and tvOS. It supports only the cbcs scheme, so packaging in cbcs lets one CMAF asset serve Widevine, PlayReady and FairPlay clients. **Widevine vs. HLS AES-128:** HLS AES-128 encrypts whole segments and serves the key over HTTPS to any authorized client. It has no device attestation, no hardware path and no output protection, so it does not meet studio requirements for HD. ## **Common Misconceptions About Widevine DRM** - **"L3 means no protection."** L3 raises the cost of extraction and is accepted for SD. The real risk is single-key packaging that lets L3 unlock HD. - **"The CDN must support Widevine."** The CDN only delivers ciphertext. DRM is enforced between the CDM and the license server. - **"An app update can restore L1."** L1 depends on device credentials and firmware. A rooted or revoked device stays on L3. - **"DRM stops screen recording everywhere."** Only the L1 secure video path, together with HDCP, blocks capture. L3 in a desktop browser relies on operating system cooperation. ## **FAQ: Widevine L1, L3 and DRM Playback** ### How do I check if my phone has Widevine L1 or L3? Run a DRM info app on Android, or query MediaDrm's securityLevel property, which returns L1 or L3. Most mid-range and flagship Android devices ship with L1. Devices drop to L3 after bootloader unlocking, rooting, certain firmware updates, or keybox revocation. Streaming apps read the same value to decide which resolutions to offer. ### Why does Netflix play in SD on my Widevine L3 device? Services like Netflix gate HD and 4K keys behind Widevine L1 because software-only L3 keys can be extracted. On an L3 device the license server releases only SD keys, typically 480p to 540p on Android. The fix is a device with intact L1 certification, not an app setting or a reinstall. ### Does Chrome use Widevine L1 or L3? Desktop Chrome on Windows, macOS and Linux uses Widevine L3, a software CDM. Most premium services therefore cap Chrome playback at 720p or 1080p rather than 4K. ChromeOS and Android devices with hardware support can run L1, and Windows browsers reach 4K through PlayReady SL3000 in Microsoft Edge instead. ### Can Widevine DRM content be cached on a CDN? Yes. Widevine-encrypted segments and manifests are identical for every viewer, so they cache like any static media object. Only the license request is unique per session and must bypass the cache to reach the license proxy. Keep license endpoints on a separate hostname with their own rate limits and capacity planning. ## **Audit Your Widevine Key Policy and Segment Delivery This Week** Pull a sample of your license server logs and group grants by security level and key ID. If any L3 request receives a key that also protects 720p or higher renditions, repackage with separate keys for audio, SD, HD and UHD before your next catalog update. Then measure license round-trip time against time to first frame on cold starts. If the license accounts for more than about a third of startup, move the proxy closer to viewers or prefetch licenses during the manifest fetch. For the encrypted segments themselves, BlazingCDN delivers DRM-packaged VOD and live catalogs on progressive per-TB pricing, described on the [**BlazingCDN OTT and VOD streaming CDN page**](https://blazingcdn.com/ott-vod-streaming-cdn/). Share: [f](https://www.facebook.com/sharer/sharer.php?u=https://blog.blazingcdn.com/en-us/what-is-widevine-drm-l1-l2-and-l3-explained) [in](https://www.linkedin.com/sharing/share-offsite/?url=https://blog.blazingcdn.com/en-us/what-is-widevine-drm-l1-l2-and-l3-explained) [๐•](https://twitter.com/intent/tweet?url=https://blog.blazingcdn.com/en-us/what-is-widevine-drm-l1-l2-and-l3-explained&text=) [โœ‰](mailto:?subject=%3Cspan%20id="hs_cos_wrapper_name"%20class="hs_cos_wrapper%20hs_cos_wrapper_meta_field%20hs_cos_wrapper_type_text"%20style=""%20data-hs-cos-general-type="meta_field"%20data-hs-cos-type="text"%20%3EWhat%20Is%20Widevine%20DRM?%20L1,%20L2%20and%20L3%20Explained%3C/span%3E&body=https://blog.blazingcdn.com/en-us/what-is-widevine-drm-l1-l2-and-l3-explained) ![BlazingCDN](https://blog.blazingcdn.com/hs-fs/hubfs/Logo/blog-logo-w.png?height=24&name=blog-logo-w.png) *Heavy traffic.* Light bill. The CDN for video and large traffic Their monthly bill vs ours - 20 TBFastly $2,087**$92.50** - 50 TBCDN77 $990**$215** - 200 TBCloudFront $11,965**$765** Published list prices, Aug 2026 [Calculate your cost](https://blazingcdn.com/cdn-cost-calculator/?utm_source=blog&utm_medium=sidebar&utm_campaign=blog_sidebar&utm_content=compare_calc) ## Related posts [![](https://blog.blazingcdn.com/hubfs/Gemini-Blog/image-Nov-01-2026-06-25-16-5332-AM.jpeg)](https://blog.blazingcdn.com/en-us/jitter-and-packet-loss-cdn-network-quality-beyond-latency?hsLang=en-us) Learn ### [What Is Packet Loss and Jitter? Causes, Tests and Fixes](https://blog.blazingcdn.com/en-us/jitter-and-packet-loss-cdn-network-quality-beyond-latency?hsLang=en-us) Packet loss is the share of packets that leave a sender but never reach the receiver, and jitter is the variation in ... Nov 1, 2026, 7:27:34โ€ฏAM [Read more](https://blog.blazingcdn.com/en-us/jitter-and-packet-loss-cdn-network-quality-beyond-latency?hsLang=en-us) [![](https://blog.blazingcdn.com/hubfs/Gemini-Blog/image-Nov-01-2026-05-55-11-5773-AM.jpeg)](https://blog.blazingcdn.com/en-us/what-is-cache-hit-definition-use-cases-and-enterprise-context?hsLang=en-us) Learn ### [What Is a Cache Hit? Cache Hit Ratio Explained and Improved](https://blog.blazingcdn.com/en-us/what-is-cache-hit-definition-use-cases-and-enterprise-context?hsLang=en-us) Raising a CDN's cache hit ratio from 95% to 99% cuts requests reaching the origin by 80%, from 50,000 to 10,000 per ... Nov 1, 2026, 6:57:08โ€ฏAM [Read more](https://blog.blazingcdn.com/en-us/what-is-cache-hit-definition-use-cases-and-enterprise-context?hsLang=en-us) [![BlazingCDN](https://blog.blazingcdn.com/hubfs/Logo/blog-logo-w.png)](https://blog.blazingcdn.com?hsLang=en-us) [๐Ÿ“˜ Learn](https://blog.blazingcdn.com/cdn-learn?hsLang=en-us) [๐Ÿ“Š Benchmarks](https://blog.blazingcdn.com/cdn-ratings-and-benchmarks?hsLang=en-us) [๐ŸŽฌ Video & Streaming](https://blog.blazingcdn.com/video-streaming-cdn?hsLang=en-us) [๐Ÿญ Industries](https://blog.blazingcdn.com/cdn-industry-insights?hsLang=en-us) [๐Ÿ’ฐ Pricing & Costs](https://blog.blazingcdn.com/cdn-pricing-and-cdn-costs?hsLang=en-us) [โšก Compare](https://blog.blazingcdn.com/cdn-comparison?hsLang=en-us) [๐Ÿ”’ Security](https://blog.blazingcdn.com/cdn-security?hsLang=en-us) [๐Ÿ› ๏ธ Tools](https://blog.blazingcdn.com/cdn-tools?hsLang=en-us) [โœ๏ธ Publish with us](https://blog.blazingcdn.com/publish-with-us?hsLang=en-us) in f ๐• โœ‰ Copyright ยฉ BlazingCDN |. All rights reserved. ```json { "@context" : "https://schema.org", "@id" : "https://blazingcdn.com/#organization", "@type" : "Organization", "description" : "High-volume CDN for video, live streaming, OTT/IPTV, software, games, SaaS and large-file delivery.", "logo" : { "@id" : "https://blazingcdn.com/#logo", "@type" : "ImageObject", "height" : 560, "url" : "https://blazingcdn.com/wp-content/uploads/2024/08/logo-560-560.png", "width" : 560 }, "name" : "BlazingCDN", "sameAs" : [ "https://www.linkedin.com/company/blazingcdn", "https://x.com/BlazingCdn", "https://www.reddit.com/r/BlazingCDN/", "https://www.wikidata.org/wiki/Q141711074" ], "url" : "https://blazingcdn.com/" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://blog.blazingcdn.com/#website", "@type" : "WebSite", "inLanguage" : "en-US", "name" : "BlazingCDN Blog", "publisher" : { "@id" : "https://blazingcdn.com/#organization" }, "url" : "https://blog.blazingcdn.com/" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://blog.blazingcdn.com/en-us/what-is-widevine-drm-l1-l2-and-l3-explained#article", "@type" : "BlogPosting", "author" : { "@id" : "https://blog.blazingcdn.com/en-us/author/blazingcdn#person", "@type" : "Person", "description" : "Vadym Borovskyi is Chief Product and Marketing Officer at BlazingCDN, where he has led product strategy and growth since 2021. He has more than 11 years of experience in IT product management and B2B marketing. On this blog he writes about CDN pricing and egress costs, video and software delivery, cache configuration, and how teams evaluate and switch CDN providers. He is based in Warsaw, Poland.", "image" : "https://143144902.fs1.hubspotusercontent-eu1.net/hubfs/143144902/vadym-borovskyi.jpg", "jobTitle" : "Chief Product and Marketing Officer", "knowsAbout" : [ "Content Delivery Networks (CDN)", "CDN pricing", "Video streaming delivery", "Software and game distribution", "Cache optimization", "Product Management", "B2B Marketing", "Digital Marketing", "Pay Per Click Marketing (PPC)", "Google Ads", "Search Engine Marketing (SEM)", "Marketing Strategy", "Artificial Intelligence (AI)", "Cloud Management", "SaaS Development", "IT Consulting", "Computer Networking", "Project Management", "Startups" ], "name" : "Vadym Borovskyi", "sameAs" : [ "https://www.linkedin.com/in/axelt/" ], "url" : "https://blog.blazingcdn.com/en-us/author/blazingcdn", "worksFor" : { "@id" : "https://blazingcdn.com/#organization" } }, "dateModified" : "2026-11-01T06:57:36Z", "datePublished" : "2026-11-01T06:57:36Z", "description" : "What is Widevine DRM? Learn how Widevine L1, L2 and L3 protect streaming content and affect video quality and device security.", "headline" : "What Is Widevine DRM? L1, L2 and L3 Explained", "image" : "https://143144902.fs1.hubspotusercontent-eu1.net/hubfs/143144902/Gemini-Blog/image-Nov-01-2026-06-55-36-5559-AM.jpeg", "inLanguage" : "en-us", "isPartOf" : { "@id" : "https://blog.blazingcdn.com/#website" }, "mainEntityOfPage" : { "@id" : "https://blog.blazingcdn.com/en-us/what-is-widevine-drm-l1-l2-and-l3-explained", "@type" : "WebPage" }, "publisher" : { "@id" : "https://blazingcdn.com/#organization" }, "wordCount" : 1609 } ``` ```json { "@context" : "https://schema.org", "@id" : "https://blog.blazingcdn.com/en-us/what-is-widevine-drm-l1-l2-and-l3-explained#breadcrumb", "@type" : "BreadcrumbList", "itemListElement" : [ { "@type" : "ListItem", "item" : "https://blog.blazingcdn.com/en-us", "name" : "Blog", "position" : 1 }, { "@type" : "ListItem", "item" : "https://blog.blazingcdn.com/en-us/what-is-widevine-drm-l1-l2-and-l3-explained", "name" : "What Is Widevine DRM? L1, L2 and L3 Explained", "position" : 2 } ] } ``` ```json { "@context" : "https://schema.org", "@id" : "https://blog.blazingcdn.com/en-us/what-is-widevine-drm-l1-l2-and-l3-explained#faq", "@type" : "FAQPage", "mainEntity" : [ { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Run a DRM info app on Android, or query MediaDrm's securityLevel property, which returns L1 or L3. Most mid-range and flagship Android devices ship with L1. Devices drop to L3 after bootloader unlocking, rooting, certain firmware updates, or keybox revocation. Streaming apps read the same value to decide which resolutions to offer." }, "name" : "How do I check if my phone has Widevine L1 or L3?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Services like Netflix gate HD and 4K keys behind Widevine L1 because software-only L3 keys can be extracted. On an L3 device the license server releases only SD keys, typically 480p to 540p on Android. The fix is a device with intact L1 certification, not an app setting or a reinstall." }, "name" : "Why does Netflix play in SD on my Widevine L3 device?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Desktop Chrome on Windows, macOS and Linux uses Widevine L3, a software CDM. Most premium services therefore cap Chrome playback at 720p or 1080p rather than 4K. ChromeOS and Android devices with hardware support can run L1, and Windows browsers reach 4K through PlayReady SL3000 in Microsoft Edge instead." }, "name" : "Does Chrome use Widevine L1 or L3?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Yes. Widevine-encrypted segments and manifests are identical for every viewer, so they cache like any static media object. Only the license request is unique per session and must bypass the cache to reach the license proxy. Keep license endpoints on a separate hostname with their own rate limits and capacity planning." }, "name" : "Can Widevine DRM content be cached on a CDN?" } ] } ```