topic Re: Mobile application session replay and masking in Real User Monitoring

Mobile application session replay and masking

Conal_Buchanan1 — Mon, 27 Mar 2023 13:28:14 GMT

For some context I've been requested to configure a mobile application in 2 situations.

In the dev or low environment the app will have no masking.

In production the app should have full masking enabled.

We've configured an application with full masking using these settings:

gradle:

userActions { namePrivacy true }

kotlin

val config: MaskingConfiguration = Safest()

I've attached a screenshot of what the recording looks like in session replay.

I would like to confirm if this is what we would expect to see.

Are there any components that should be visible in the Safest() configuration?

Are production setup's typically configured in Safe() mode?

Re: Mobile application session replay and masking

Patrick_H — Tue, 28 Mar 2023 06:30:57 GMT

Yes, in safest all labels, fields etc. are blacked out. There is no typical production setup as it depends on what the customers and end users privacy needs. E.g. if most elements do not contain any PII (like OK buttons, general not user related text) or if the view contains lots of PII (think of a listing of your bank account)

Re: Mobile application session replay and masking

Conal_Buchanan1 — Wed, 29 Mar 2023 09:30:03 GMT

Ok thanks, wanted to make sure it's not a bug in our configuration.

Will try reducing the masking level.

Re: Mobile application session replay and masking

paul_kapeller — Wed, 29 Mar 2023 14:23:21 GMT

FYI: we described the masking configurations you can make in our documentation.

For example for Android: https://www.dynatrace.com/support/help/platform-modules/digital-experience/session-replay/session-replay-android

Re: Mobile application session replay and masking

Conal_Buchanan1 — Wed, 12 Apr 2023 09:29:25 GMT

Thank you for the documentation.

There are a few points I'm unsure of.

I've noticed in testing that sometimes the recording doesn't show the settings I've used.
For instance I set safe() mode but the recording is still masking at safest() level.

Is there a way to read what the current configuration is?
Is it better to call at startup or when the user opts in?

Re: Mobile application session replay and masking

carlos_munoz — Wed, 12 Apr 2023 10:01:17 GMT

As documented:

Safest—all the editable texts fields, images, labels, web views, and switches are masked.
Safe—all the editable texts fields are masked.
Custom—by default, masks the same elements as Safest, but you can decide exactly which app components or views should be masked.

If you set the masking at the middle of a session, the first half will be SAFEST and the second half will be the new configuration. So the masking is only applied for events produced since the set of the new configuration, but not backwards.

It's not possible to read the current Masking configuration. There can be only set. Sorry for that.
We usually recommend to set up the masking at the very beginning of the startup. You can also wait for the opt in and apply the masking based on it.