Skip to main content

Recording Session Replays for Unauthenticated Users

This article explains how to record session replays in Fullview before a user logs in, and optionally how to update that session with the user’s real identity once authentication is complete.

A
Written by Alex
Updated over a week ago

This setup is useful if you want visibility into:

  • Login screen behavior

  • 2FA or verification flows

  • Failed login attempts

  • General pre-auth UX friction

The core idea:

You can start a session with a temporary (anonymous) ID. Updating it to a real user ID after login is recommended, but optional.


High-level approach

  1. Load the Fullview script on unauthenticated pages (login, signup, 2FA, etc.).

  2. Before the user is authenticated, identify them with a temporary, randomized ID.

  3. Store that temporary ID somewhere stable (cookies or session ID).

  4. (Optional) After login, call identify again with the real user ID and name.

  5. Fullview will either:

    • Continue showing the session as anonymous, or

    • Associate the entire session (pre- and post-login) with the authenticated user.


Step 1: Install Fullview on unauthenticated pages

Make sure the Fullview snippet is loaded on pages before login.

If you only load Fullview after authentication, pre-login activity will not be captured.


Step 2: Generate a temporary (anonymous) user ID

Before the user logs in, you typically won’t have a real user ID yet.

In that case, generate a temporary ID that:

  • Is unique per visitor

  • Stays consistent across the session

  • Can be reused after login if you choose to update the user

Good sources for this ID:

  • A session ID

  • A cookie value

Example:

const anonymousId = getOrCreateSessionId();


Step 3: Identify the unauthenticated user in Fullview

Once you have a temporary ID, pass it to Fullview using identify.

You can use the ID directly, or encode it into the name field for clarity.

Example:

window.FV('identify', {   id: anonymousId,   name: `visitor-${anonymousId}` });

At this point:

  • The session will appear in Fullview

  • The user will show up as something like visitor-123

  • Login and 2FA steps will be visible in the replay

This alone is sufficient to record unauthenticated sessions.


Step 4 (Optional): Update the user after login

If you want the session to be associated with a known user, you can update the identity after successful authentication.

Call identify again with the real user information.

Example:

window.FV('identify', {   id: user.id,           // real internal user ID   name: user.fullName   // or email / display name });

Notes:

  • This step is optional

  • You do not need to start a new session

  • Pre-login activity will remain attached to the same replay

If you skip this step, the session will remain anonymous.


Recommended implementation details

  • Use a stable temporary ID (cookie or session ID), not a new value per page load

  • Call identify as early as possible on unauthenticated pages

  • If updating after login, call identify again immediately after authentication success

A common pattern:

  1. App loads → generate or read anonymous ID → identify(visitor)

  2. User logs in → (optional) identify(user)


What Fullview requires

Fullview requires a user.id to associate sessions with users.

  • For unauthenticated recording, this can be a temporary ID

  • For identified users, this should be your real internal user ID

Both approaches are valid, depending on your use case.


Common pitfalls

  • Not loading Fullview on login pages → nothing to record

  • Using a new random ID on every page → sessions won’t stitch correctly

  • Expecting the user name to update automatically without calling identify again


Summary

To record unauthenticated users in Fullview:

  • Load Fullview before login

  • Identify users with a temporary ID

  • Persist that ID across the session

  • Optionally re-identify with a real user ID after login

This gives you visibility into pre-login behavior, with the flexibility to keep sessions anonymous or associate them with users once authenticated.

Did this answer your question?