Browse Definitions :
Definition

session replay script

A session-replay script is programming that enables a website users’ keystrokes, clicks, mouse movements and scrolling behavior to be recorded along with the full contents of the webpage they are visiting. Session replay is a popular tool for helping companies determine how their websites are being used and for identifying potential problems such as broken links, page design issues or reasons users leave a site. 

With session replay, a third-party analytics service provider supplies the website publisher with HTML to insert in each webpage's source code.  In contrast with scripts that simply aggregate statistics for such things as unique users or time on site, session-replay scripts record individual browsing sessions and send the data back to the service provider's servers. The recordings can then be viewed on demand by the publisher. The use of session-reply scripts is controversial because of the potential for privacy violations. 

A Princeton University study found that more 400 heavily trafficked websites contained session-replay scripts. The study also revealed that requests for user opt-in were non-existent and data was not always be handled securely. The researchers found that although service providers intended to automatically redact sensitive information, such as passwords and credit card information, the process is flawed. 

Sometimes more information is gathered than expected because the script can't distinguish between information that is helpful for improving the site’s user interface (UI) and information that needs to remain private by law. For example, health-related information typed into a web form could be recorded by the script and sent to the service provider accidently if the website visitor ultimately decides not to submit the form. In this case, if the visitor had actually submitted the form, the data would have been redacted. Because the form was filled out but not submitted, however, it remained part of the recording. 

To avoid accidentally leaking private data, website publishers need to identify all pages that display or accept user information and manually scrub sensitive information when it is inadvertently gathered. This process, which involves inspecting the underlying server-side code, can be time-consuming and must be repeated whenever the site is updated or a web app powering the site is changed.

To prevent a browser session from being recorded, end users can adjust browser settings to prevent all scripts from running, but this approach may also limit the functionality of some websites. Another option is to use a browser extension such as NoScript, uBlock Origin or uMatrix and only allow scripts to run on sites that have been whitelisted by the user.

This was last updated in December 2017

Continue Reading About session replay script

SearchCompliance
  • OPSEC (operations security)

    OPSEC (operations security) is a security and risk management process and strategy that classifies information, then determines ...

  • smart contract

    A smart contract is a decentralized application that executes business logic in response to events.

  • compliance risk

    Compliance risk is an organization's potential exposure to legal penalties, financial forfeiture and material loss, resulting ...

SearchSecurity
  • buffer overflow

    A buffer overflow occurs when a program or process attempts to write more data to a fixed-length block of memory, or buffer, than...

  • biometric verification

    Biometric verification is any means by which a person can be uniquely identified by evaluating one or more distinguishing ...

  • password

    A password is a string of characters used to verify the identity of a user during the authentication process.

SearchHealthIT
SearchDisasterRecovery
  • What is risk mitigation?

    Risk mitigation is a strategy to prepare for and lessen the effects of threats faced by a business.

  • change control

    Change control is a systematic approach to managing all changes made to a product or system.

  • disaster recovery (DR)

    Disaster recovery (DR) is an organization's ability to respond to and recover from an event that affects business operations.

SearchStorage
  • What is RAID 6?

    RAID 6, also known as double-parity RAID, uses two parity stripes on each disk. It allows for two disk failures within the RAID ...

  • PCIe SSD (PCIe solid-state drive)

    A PCIe SSD (PCIe solid-state drive) is a high-speed expansion card that attaches a computer to its peripherals.

  • VRAM (video RAM)

    VRAM (video RAM) refers to any type of random access memory (RAM) specifically used to store image data for a computer display.

Close