A well-built private Web App can tell you who signed in, when they authenticated, what role they held and which resources the server returned. That audit trail is valuable—until the information leaves as an image.
A screenshot contains pixels, not your application logs. If several authorised users could see the same dashboard, those pixels may look identical no matter who captured them.
Access and attribution answer different questions
Authentication answers: “Who was allowed to open this page?”
Screenshot attribution asks: “Which protected viewing session is this image connected to?”
Without a session-specific signal in the rendered page, the second question is usually reduced to comparing timestamps, access lists and assumptions. A login log can establish opportunity, but opportunity is not the same as source attribution.
Where ExactMark fits
The ExactMark SDK runs on authenticated pages and applies a covert, server-backed signal to the verified Web Session. Your application passes a stable random viewer reference that only it can map to the signed-in account, together with a short-lived token issued by its backend.
A basic integration looks like this:
<script src="https://exactmark.com/sdk.js"
data-property="YOUR_PROPERTY_KEY"></script>exactmark.identify(viewerReference, {
viewerToken
});ExactMark does not replace your authentication system. Your backend keeps the private reference-to-account mapping and signs the reference only after it has authenticated the viewer.
Sign every attribution-ready viewer reference
A browser can modify client-side JavaScript, so a valid server-issued token is required before a Web Session can enter Evidence Lab attribution. The token binds the opaque viewer reference to the correct Web App and prevents browser code from substituting another reference.
The server signs only the token version, opaque viewer reference, Web App key and short expiry after authentication. Keep the signing secret on the server and never place it in browser code.
What the SDK does not collect
The SDK is designed to protect the rendered surface without capturing the page content itself. It does not accept names, email addresses, usernames, raw account IDs or page paths, and it does not record form fields, keystrokes or screenshots. ExactMark stores the opaque viewer reference and minimal session metadata needed for attribution; the customer keeps the only mapping back to the account.
That separation is important for products handling financial, personal, legal or commercially sensitive information.
Test the complete loop
Installation is not complete because a script tag appeared in the source. Use a controlled test account and verify the full workflow:
- Sign in to the protected Web App.
- Confirm the verified opaque reference appears in Web Sessions.
- Check the reference, Web App and session timing information.
- Take a screenshot from that test session.
- Submit it to Evidence Lab using the Web Apps search scope.
- Confirm the expected session is returned with meaningful confidence.
Repeat the test after material frontend changes, content-security-policy updates or authentication refactors.
Treat the result as evidence, not a verdict
Cropping, recompression, resizing and photography can weaken the signal. ExactMark reports confidence and candidate separation because real-world evidence is rarely perfect. Review the complete finding and corroborate it with your application logs before taking consequential action.
Access controls still do the primary job of keeping unauthorised people out. Screenshot attribution addresses the different moment when an authorised view becomes a detached image. A mature private application needs to understand both sides of that boundary.