What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 134 Stack Exchange communities.

Recently I noticed the following remarkable automatic login behavior:

After resetting Safari:

Image of Safari reset dialog box

Stack Overflow is always automatically logged in again:

Auto Login

I always assumed to be logged out everywhere after resetting Safari.
Apparently Stack Overflow is still able to automatically login again.

How can Stack Overflow automatically login after resetting Safari?
And how can I prevent this behavior? In my opinion this is not secure.

share|improve this question
    
This has never happened to me in Chrome. Strange... –  alex Oct 26 '11 at 5:13
    
See also Global Network Auto-Login on the blog, and How does SO's new auto-login feature work? here on Meta. (And How to clear all HTML5 local storage from Safari? on Super User.) –  Arjan Oct 31 '11 at 19:10

1 Answer 1

up vote 14 down vote accepted

I believe Stack Overflow uses Web Storage to locally store login preferences, and your OpenID/OAuth provider might be doing that as well. If you’ve enabled the Develop menu (Preferences > Advanced > Show Develop menu in menu bar), you can fire the Web Inspector (Develop > Show Web Inspector) and select Resources > Local Storage to inspect what has been locally stored by stackoverflow.com (in my case, meta.stackoverflow.com has stored a key-value pair with key login-prefs).

I also believe you’re using and ‘old’ version of Safari. Version 5.1.1 (7534.51.22), when asked to reset Safari, shows a ‘Remove all website data’ option as the last checkbox whilst your screenshot doesn’t list that option. If I select that checkbox when resetting Safari, I need to log on to Stack Overflow again, so it certainly removes Web storage.

You should also be able to remove local storage with Preferences > Privacy > Remove All Website Data…, at least on Safari 5.1.1. Furthermore, the Details… button shows how a given Web site is using local data: cache, cookies or local (Web) storage.

share|improve this answer
    
Nice change; previous versions did not allow for deleting this at all! –  Arjan Oct 31 '11 at 18:54
3  
By the way: one should not look at the current site, but at stackauth.com and then peek into localStorage.getItem('GlobalLogin'). See also Global Network Auto-Login on the blog, and How does SO's new auto-login feature work? here on Meta. –  Arjan Oct 31 '11 at 19:12
    
@Arjan Oh, nice. Thanks for the references. –  Bavarious Oct 31 '11 at 22:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .