Browse Definitions :
Definition

session replay script

Contributor(s): Corinne Bernstein

A session-replay script is programming that enables a website users’ keystrokes, clicks, mouse movements and scrolling behavior to be recorded along with the full contents of the webpage they are visiting. Session replay is a popular tool for helping companies determine how their websites are being used and for identifying potential problems such as broken links, page design issues or reasons users leave a site. 

With session replay, a third-party analytics service provider supplies the website publisher with HTML to insert in each webpage's source code.  In contrast with scripts that simply aggregate statistics for such things as unique users or time on site, session-replay scripts record individual browsing sessions and send the data back to the service provider's servers. The recordings can then be viewed on demand by the publisher. The use of session-reply scripts is controversial because of the potential for privacy violations. 

A Princeton University study found that more 400 heavily trafficked websites contained session-replay scripts. The study also revealed that requests for user opt-in were non-existent and data was not always be handled securely. The researchers found that although service providers intended to automatically redact sensitive information, such as passwords and credit card information, the process is flawed. 

Sometimes more information is gathered than expected because the script can't distinguish between information that is helpful for improving the site’s user interface (UI) and information that needs to remain private by law. For example, health-related information typed into a web form could be recorded by the script and sent to the service provider accidently if the website visitor ultimately decides not to submit the form. In this case, if the visitor had actually submitted the form, the data would have been redacted. Because the form was filled out but not submitted, however, it remained part of the recording. 

To avoid accidentally leaking private data, website publishers need to identify all pages that display or accept user information and manually scrub sensitive information when it is inadvertently gathered. This process, which involves inspecting the underlying server-side code, can be time-consuming and must be repeated whenever the site is updated or a web app powering the site is changed.

To prevent a browser session from being recorded, end users can adjust browser settings to prevent all scripts from running, but this approach may also limit the functionality of some websites. Another option is to use a browser extension such as NoScript, uBlock Origin or uMatrix and only allow scripts to run on sites that have been whitelisted by the user.

This was last updated in December 2017

Continue Reading About session replay script

Join the conversation

1 comment

Send me notifications when other members comment.

Please create a username to comment.

Do you use an ad blocker on your browser? Why?
Cancel

-ADS BY GOOGLE

File Extensions and File Formats

Powered by:

SearchCompliance

  • risk management

    Risk management is the process of identifying, assessing and controlling threats to an organization's capital and earnings.

  • compliance as a service (CaaS)

    Compliance as a Service (CaaS) is a cloud service service level agreement (SLA) that specified how a managed service provider (...

  • data protection impact assessment (DPIA)

    A data protection impact assessment (DPIA) is a process designed to help organizations determine how data processing systems, ...

SearchSecurity

  • Port Scan

    A port scan is a series of messages sent by someone attempting to break into a computer to learn which computer network services ...

  • DMZ (networking)

    In computer networks, a DMZ (demilitarized zone), also sometimes known as a perimeter network or a screened subnetwork, is a ...

  • quantum supremacy

    Quantum supremacy is the experimental demonstration of a quantum computer's dominance and advantage over classic computers by ...

SearchHealthIT

SearchDisasterRecovery

  • business continuity plan (BCP)

    A business continuity plan (BCP) is a document that consists of the critical information an organization needs to continue ...

  • disaster recovery team

    A disaster recovery team is a group of individuals focused on planning, implementing, maintaining, auditing and testing an ...

  • cloud insurance

    Cloud insurance is any type of financial or data protection obtained by a cloud service provider. 

SearchStorage

Close