Browse Definitions :
Definition

session replay script

A session-replay script is programming that enables a website users’ keystrokes, clicks, mouse movements and scrolling behavior to be recorded along with the full contents of the webpage they are visiting. Session replay is a popular tool for helping companies determine how their websites are being used and for identifying potential problems such as broken links, page design issues or reasons users leave a site. 

With session replay, a third-party analytics service provider supplies the website publisher with HTML to insert in each webpage's source code.  In contrast with scripts that simply aggregate statistics for such things as unique users or time on site, session-replay scripts record individual browsing sessions and send the data back to the service provider's servers. The recordings can then be viewed on demand by the publisher. The use of session-reply scripts is controversial because of the potential for privacy violations. 

A Princeton University study found that more 400 heavily trafficked websites contained session-replay scripts. The study also revealed that requests for user opt-in were non-existent and data was not always be handled securely. The researchers found that although service providers intended to automatically redact sensitive information, such as passwords and credit card information, the process is flawed. 

Sometimes more information is gathered than expected because the script can't distinguish between information that is helpful for improving the site’s user interface (UI) and information that needs to remain private by law. For example, health-related information typed into a web form could be recorded by the script and sent to the service provider accidently if the website visitor ultimately decides not to submit the form. In this case, if the visitor had actually submitted the form, the data would have been redacted. Because the form was filled out but not submitted, however, it remained part of the recording. 

To avoid accidentally leaking private data, website publishers need to identify all pages that display or accept user information and manually scrub sensitive information when it is inadvertently gathered. This process, which involves inspecting the underlying server-side code, can be time-consuming and must be repeated whenever the site is updated or a web app powering the site is changed.

To prevent a browser session from being recorded, end users can adjust browser settings to prevent all scripts from running, but this approach may also limit the functionality of some websites. Another option is to use a browser extension such as NoScript, uBlock Origin or uMatrix and only allow scripts to run on sites that have been whitelisted by the user.

This was last updated in December 2017

Continue Reading About session replay script

SearchCompliance

  • information governance

    Information governance is a holistic approach to managing corporate information by implementing processes, roles, controls and ...

  • enterprise document management (EDM)

    Enterprise document management (EDM) is a strategy for overseeing an organization's paper and electronic documents so they can be...

  • risk assessment

    Risk assessment is the identification of hazards that could negatively impact an organization's ability to conduct business.

SearchSecurity

  • honeypot (computing)

    A honeypot is a network-attached system set up as a decoy to lure cyber attackers and detect, deflect and study hacking attempts ...

  • spam trap

    A spam trap is an email address that is used to identify and monitor spam email.

  • cracker

    A cracker is someone who breaks into someone else's computer system, often on a network; bypasses passwords or licenses in ...

SearchHealthIT

SearchDisasterRecovery

  • risk mitigation

    Risk mitigation is a strategy to prepare for and lessen the effects of threats faced by a business.

  • call tree

    A call tree is a layered hierarchical communication model that is used to notify specific individuals of an event and coordinate ...

  • Disaster Recovery as a Service (DRaaS)

    Disaster recovery as a service (DRaaS) is the replication and hosting of physical or virtual servers by a third party to provide ...

SearchStorage

  • cloud storage

    Cloud storage is a service model in which data is transmitted and stored on remote storage systems, where it is maintained, ...

  • cloud testing

    Cloud testing is the process of using the cloud computing resources of a third-party service provider to test software ...

  • storage virtualization

    Storage virtualization is the pooling of physical storage from multiple storage devices into what appears to be a single storage ...

Close