Session Management

netbobr runs entirely in your browser and is ephemeral by default - none of your flows, zones or rules are stored in localStorage, sessionStorage, or cookies, and no data is sent to any server. Session management lets you save and restore your work across browser sessions.

Open Session Control in the header to reach Load, Save and Reset.

Save session

Click Save to download a JSON file with your current state:

• Flows - the manual flow inputs (up to 20) and the last results, either the manual results or the batch results table (including the imported file name, error rows and cloud rule metadata such as the rule name and direction).
• Zones - zone names, subnets, the policy matrix and the intra-zone and inter-zone defaults.
• Rule toggles - which built-in and framework rules are switched off.
• View - collapsed sections and sort order on the Rules tab, and the active tab.
• Custom rules and zone attributes - advanced settings that have no editor in the app yet. You can add them by editing the session JSON. Zone attributes are keyed by zone name, for example "zoneAttributes": {"Corp": {"classification": "restricted"}}.

The file uses session format 5. It records "zoneAttributesKeyedBy": "name".

Load session

Click Load and select a saved JSON file. Loading replaces all current state: flows, results, zones, zone attributes, custom rules and rule toggles. A part missing from the file is reset to its default.

netbobr checks the file before changing anything:

• Errors - nothing is changed and the status shows the reason in red, ending with "Nothing was changed.":
  • the file is not valid JSON;
  • the file is not a session: a JSON array, a cloud export, a CLI config, or an object without a version and session data;
  • a section has the wrong type, for example zoneMatrix is not an object or flowInputs is not a list;
  • the file was saved by a newer netbobr. This version reads formats 1 to 5.
• Warnings - the problem item is dropped or adjusted and everything else loads. The status shows Session restored with N warning(s) in amber; hover over it to see every warning. Warnings cover:
  • zones with an invalid name, subnet or host bits;
  • more than 10 zones;
  • a subnet already defined in another zone;
  • unknown rule IDs;
  • flows over the limit;
  • results that cannot be re-analysed;
  • invalid custom rules or zone attributes.
• Session restored. in green appears only when nothing was dropped or shortened. A few adjustments do not change the meaning of your data, so they are made silently:
  • protocol, severity and logic values are upper-cased;
  • text is trimmed;
  • a condition value given as a list, such as ["TCP", "UDP"] for in, is stored as "TCP,UDP";
  • the unevaluated rule DORA-NET-033 is removed from the disabled-rules list;
  • risk score weight settings from older versions are ignored.

Results are re-analysed on load. netbobr never displays the stored result objects. Each saved flow or batch row is analysed again from its inputs, with the current engine, zones, rule toggles and custom rules. Scores in an old session can therefore differ from the scores at the time it was saved. Batch error rows, row numbers, the file name and cloud rule metadata are kept.

Older session files

• Formats 1 to 4 still load.
• Their zone attributes were keyed by internal zone IDs (z1, z2, …). On load, z1 maps to the first zone in the file's zone list, z2 to the second, and so on, and a warning asks you to check them. The mapping is only wrong if zones had been deleted before that session was saved.
• Risk score weight or threshold settings from older versions are ignored, and the default scoring applies.
• Format 2 framework on/off flags (pciMode, cisMode, …) are still honoured.

Custom rules in a session

customRules holds {"rules": [...], "nextId": n}; a bare list of rules is also accepted. Each rule has id, name, enabled, severity, logic, conditions, finding, remediation and verdictOverride. On load every rule is checked:

• logic must be AND or OR, in any case. A rule with any other logic is dropped. A missing logic means AND, with a warning.
• Every condition needs a known field and operator. A rule with an invalid condition is dropped as a whole, because dropping one condition would change what it matches.
• A condition value is text, a number, true/false or empty. A list is accepted when it keeps its meaning, for example ["TCP", "UDP"] for the in operator.
• name is cut to 200 characters, and finding and remediation to 1000 characters, with a warning.
• severity is CRITICAL, HIGH, MEDIUM, LOW or INFO in any case. Any other value becomes MEDIUM, with a warning.
• verdictOverride is DENY in any case, or empty. Other values are ignored, with a warning.
• enabled must be true or false. If it is missing, the rule is disabled, with a warning.
• An ID with characters other than letters, digits and _ . : - is replaced by a new CUSTOM-n ID. A duplicate ID drops the later rule.
• At most 25 custom rules are kept.

Limits

Anything over a limit is ignored, with a warning.

Reset vs Clear

The app has one results area, so both Clear buttons empty it. Only Reset and Load change zones, rule toggles, zone attributes or custom rules.

Privacy model

All data stays in browser memory for the duration of your session. Specifically:

• No analysis data in localStorage or sessionStorage - closing the tab discards all state unless you have saved a session file. The only stored value is your light/dark theme choice.
• No cookies - netbobr sets no cookies of any kind.
• No server communication - validation, scoring, and rule evaluation all run client-side. No flow data, IP addresses, or rule configurations leave your browser.

If your organization requires an audit trail, save sessions to a shared location and treat the JSON files as your record of analysis.