[Docs]: Playwright CDN

[ChristianHuff-DEV]

Page(s)

https://playwright.dev/docs/browsers#install-browsers

Description

The organization I work for is currently in the process of evaluating Playwright. Part of this process is a risk assessment to ensure software security, compliance with regulatory requirements and ISO standards.

Thanks to Playwright being open source and the transparency around it, Playwright itself is no issue. But we have questions regarding the CDN mirrors that are not explicitly answered in the documentation.

We found that there are three mirrors:

https://playwright.azureedge.net/ https://playwright-akamai.azureedge.net/ https://playwright-verizon.azureedge.net/

• Can you confirm that all three mirrors are under the control of Microsoft and the Playwright team respectively? Our concern is that the subdomains under azureedge.net are part of the Azure CDN and could be vulnerable to subdomain takeover attacks when the responsibilities for the subdomains are not well defined.
• Is the process of creating and uploading the binaries part of this repository or any other repository in the Microsoft organisation where we could review it?

[mxschmitt]

Can you confirm that all three mirrors are under the control of Microsoft and the Playwright team respectively?

We own and plan to continue to maintain them in the future.

Is the process of creating and uploading the binaries part of this repository or any other repository in the Microsoft organisation where we could review it?

The browser patches are public, Chromium is not modified. Upstream build instructions for them apply:

• https://firefox-source-docs.mozilla.org/setup/linux_build.html
• https://www.chromium.org/developers/how-tos/get-the-code/
• https://docs.webkit.org/Build%20%26%20Debug/BuildOptions.html