DRM-X 6.0 dove and olive branch logoDRM-X 6.0Docs
/
◎ English

Production security checklist

Production security checklist for DRM-X 6.0 integrations: least-privilege credentials, server-side policy, secret handling, safe logs, transport boundaries, and release lifecycle.

View MarkdownLive examplesUpdated 2026-09-05

Encrypted video and DRM licenses follow separate paths

The CDN delivers encrypted video. Your backend checks access, and the DRM license service authorizes decryption on a compatible device.

  1. Storage / CDN

    Delivers encrypted media to the player.

  2. Your backend

    Checks whether the viewer is allowed to watch and requests playback authorization from DRM-X.

  3. DRM-X

    Validates the playback authorization and handles the DRM license request.

  4. Player + device

    Uses the device's DRM system to obtain a license and play the encrypted media.

Your backend decides access; DRM-X enforces the signed policy. Encrypted media and DRM licenses follow separate delivery paths.

Credential controls#

  • Create separate Development and Production API clients.
  • Grant only license-tokens:create to playback integrations.
  • Store the Access Key in a secret manager or protected runtime configuration, not source, images, frontend bundles, APKs, IPAs, or logs.
  • Rotate immediately after suspected exposure and remove unused clients.
  • Restrict outbound calls to the expected DRM-X API and proxy origins.

Authorization controls#

  • Resolve subject from the authenticated server session.
  • Map catalog references to trusted Published protected file Content IDs on the server.
  • Map product, plan, rental, course, device, or content tier to an approved named template or complete custom policy.
  • Never accept manifest URL, license URL, policy JSON, quality entitlement, or customer identity from the player.
  • Create a fresh unpredictable session ID for each real playback attempt.

Transport and browser controls#

  • Require HTTPS; validate TLS; reject untrusted redirects.
  • Set explicit timeouts and request-size limits.
  • Attach authorization only to the returned certificate, license, renewal, and release routes.
  • Preserve native DRM challenge and license bytes exactly.
  • Return playback responses with Cache-Control: no-store and avoid persistent browser storage.

Evidence without secrets#

Record correlation ID, stage, status, duration, environment, application ID, DRM, and a safe content reference. Redact headers and query strings. Do not record Access Keys, DRM License Tokens, content keys, private keys, certificates, native challenges, license bodies, or successful playback response documents.

Accurate assurance languageDescribe the current platform controls as ISO 27001-aligned or readiness work. Do not claim accredited ISO/IEC 27001 certification until certification is actually complete.

Go-live acceptance#

  1. Prove denied entitlement, expired token, wrong DRM, wrong Content ID, and disallowed quality all fail closed.
  2. Test physical devices and output changes for every advertised platform.
  3. Confirm Stop, replacement, errors, and shutdown release concurrent reservations.
  4. Review redacted telemetry and incident runbooks.
  5. Back up protected configuration and prove restoration before launch.