Browse Definitions :
Definition

session replay script

Contributor(s): Corinne Bernstein

A session-replay script is programming that enables a website users’ keystrokes, clicks, mouse movements and scrolling behavior to be recorded along with the full contents of the webpage they are visiting. Session replay is a popular tool for helping companies determine how their websites are being used and for identifying potential problems such as broken links, page design issues or reasons users leave a site. 

With session replay, a third-party analytics service provider supplies the website publisher with HTML to insert in each webpage's source code.  In contrast with scripts that simply aggregate statistics for such things as unique users or time on site, session-replay scripts record individual browsing sessions and send the data back to the service provider's servers. The recordings can then be viewed on demand by the publisher. The use of session-reply scripts is controversial because of the potential for privacy violations. 

A Princeton University study found that more 400 heavily trafficked websites contained session-replay scripts. The study also revealed that requests for user opt-in were non-existent and data was not always be handled securely. The researchers found that although service providers intended to automatically redact sensitive information, such as passwords and credit card information, the process is flawed. 

Sometimes more information is gathered than expected because the script can't distinguish between information that is helpful for improving the site’s user interface (UI) and information that needs to remain private by law. For example, health-related information typed into a web form could be recorded by the script and sent to the service provider accidently if the website visitor ultimately decides not to submit the form. In this case, if the visitor had actually submitted the form, the data would have been redacted. Because the form was filled out but not submitted, however, it remained part of the recording. 

To avoid accidentally leaking private data, website publishers need to identify all pages that display or accept user information and manually scrub sensitive information when it is inadvertently gathered. This process, which involves inspecting the underlying server-side code, can be time-consuming and must be repeated whenever the site is updated or a web app powering the site is changed.

To prevent a browser session from being recorded, end users can adjust browser settings to prevent all scripts from running, but this approach may also limit the functionality of some websites. Another option is to use a browser extension such as NoScript, uBlock Origin or uMatrix and only allow scripts to run on sites that have been whitelisted by the user.

This was last updated in December 2017

Continue Reading About session replay script

Join the conversation

1 comment

Send me notifications when other members comment.

Please create a username to comment.

Do you use an ad blocker on your browser? Why?
Cancel

-ADS BY GOOGLE

File Extensions and File Formats

Powered by:

SearchCompliance

  • regulatory compliance

    Regulatory compliance is an organization's adherence to laws, regulations, guidelines and specifications relevant to its business...

  • privacy compliance

    Privacy compliance is a company's accordance with established personal information protection guidelines, specifications or ...

  • data governance policy

    A data governance policy is a documented set of guidelines for ensuring that an organization's data and information assets are ...

SearchSecurity

  • asymmetric cryptography (public key cryptography)

    Asymmetric cryptography, also known as public-key cryptography, is a process that uses a pair of related keys -- one public key ...

  • Evil Corp

    Evil Corp is an international cybercrime network that uses malicious software to steal money from its victims' bank accounts.

  • Plundervolt

    Plundervolt is a method of hacking that involves depriving an Intel chip of power so that processing errors occur.

SearchHealthIT

  • telemedicine (telehealth)

    Telemedicine is the remote delivery of healthcare services, such as health assessments or consultations, over the ...

  • Project Nightingale

    Project Nightingale is a controversial partnership between Google and Ascension, the second largest health system in the United ...

  • medical practice management (MPM) software

    Medical practice management (MPM) software is a collection of computerized services used by healthcare professionals and ...

SearchDisasterRecovery

SearchStorage

  • M.2 SSD

    An M.2 SSD is a solid-state drive (SSD) that conforms to a computer industry specification written for internally mounted storage...

  • RAID (redundant array of independent disks)

    RAID (redundant array of independent disks) is a way of storing the same data in different places on multiple hard disks or ...

  • cache memory

    Cache memory, also called CPU memory, is high-speed static random access memory (SRAM) that a computer microprocessor can access ...

Close