Browse Definitions:
Definition

session replay script

Contributor(s): Corinne Bernstein

A session-replay script is programming that enables a website users’ keystrokes, clicks, mouse movements and scrolling behavior to be recorded along with the full contents of the webpage they are visiting. Session replay is a popular tool for helping companies determine how their websites are being used and for identifying potential problems such as broken links, page design issues or reasons users leave a site. 

With session replay, a third-party analytics service provider supplies the website publisher with HTML to insert in each webpage's source code.  In contrast with scripts that simply aggregate statistics for such things as unique users or time on site, session-replay scripts record individual browsing sessions and send the data back to the service provider's servers. The recordings can then be viewed on demand by the publisher. The use of session-reply scripts is controversial because of the potential for privacy violations. 

A Princeton University study found that more 400 heavily trafficked websites contained session-replay scripts. The study also revealed that requests for user opt-in were non-existent and data was not always be handled securely. The researchers found that although service providers intended to automatically redact sensitive information, such as passwords and credit card information, the process is flawed. 

Sometimes more information is gathered than expected because the script can't distinguish between information that is helpful for improving the site’s user interface (UI) and information that needs to remain private by law. For example, health-related information typed into a web form could be recorded by the script and sent to the service provider accidently if the website visitor ultimately decides not to submit the form. In this case, if the visitor had actually submitted the form, the data would have been redacted. Because the form was filled out but not submitted, however, it remained part of the recording. 

To avoid accidentally leaking private data, website publishers need to identify all pages that display or accept user information and manually scrub sensitive information when it is inadvertently gathered. This process, which involves inspecting the underlying server-side code, can be time-consuming and must be repeated whenever the site is updated or a web app powering the site is changed.

To prevent a browser session from being recorded, end users can adjust browser settings to prevent all scripts from running, but this approach may also limit the functionality of some websites. Another option is to use a browser extension such as NoScript, uBlock Origin or uMatrix and only allow scripts to run on sites that have been whitelisted by the user.

This was last updated in December 2017

Continue Reading About session replay script

Join the conversation

1 comment

Send me notifications when other members comment.

By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy

Please create a username to comment.

Do you use an ad blocker on your browser? Why?
Cancel

-ADS BY GOOGLE

Extensions de fichiers et formats de fichiers

Motorisé par:

SearchCompliance

  • smart contract

    A smart contract, also known as a cryptocontract, is a computer program that directly controls the transfer of digital currencies...

  • risk map (risk heat map)

    A risk map, also known as a risk heat map, is a data visualization tool for communicating specific risks an organization faces. A...

  • internal audit (IA)

    An internal audit (IA) is an organizational initiative to monitor and analyze its own business operations in order to determine ...

SearchSecurity

SearchHealthIT

SearchDisasterRecovery

  • incident management plan (IMP)

    An incident management plan (IMP), sometimes called an incident response plan or emergency management plan, is a document that ...

  • crisis communication

    Crisis communication is a method of corresponding with people and organizations during a disruptive event to provide them with ...

  • Zerto

    Zerto is a storage software vendor that specializes in enterprise-class business continuity and disaster recovery in virtual and ...

SearchStorage

  • network-attached storage (NAS)

    Network-attached storage (NAS) is dedicated file storage that enables multiple users and heterogeneous client devices to retrieve...

  • SSD write cycle

    An SSD write cycle is the process of programming data to a NAND flash memory chip in a solid-state storage device.

  • data storage

    Data storage is the collective methods and technologies that capture and retain digital information on electromagnetic, optical ...

Close