What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 134 Stack Exchange communities.

Possible Duplicate:
Why does it says welcome back -user- click here to “refresh page”

TL;DR: This is a technical/programming question, not an off topic question about the Stack Exchange network. I'm interested in what purpose this serves as a security technicality.

This has intrigued me for a while. It is not a question about how to use StackExchange websites, or a support question - I'm interested into the specific technical reasons in why all StackExchange websites log me in after the page loads, requiring a refresh.

I'm talking about this message:

enter image description here

I can't understand why logging me in isn't done server-side, rather than as a message after the page has loaded. It's something I've never noticed on any other website.

Oddly, I don't notice this behaviour on stackoverflow.com - only other websites within the Stack Exchange network.

share|improve this question

migrated from stackoverflow.com Nov 30 '11 at 16:07

This question came from our site for professional and enthusiast programmers.

marked as duplicate by balpha Nov 30 '11 at 19:00

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

    
@juergend I am asking for the technical reasons, regarding security and application development. This question fits the scope defined in the faq stackoverflow.com/faq –  Greg Nov 30 '11 at 15:33
2  
Technical questions belong here as well and this one really reads to me like it's asking about SE specifically. One of the SE developers will be able to give the best answer, IMHO. –  Anna Lear Nov 30 '11 at 16:32
    
See also Kevin Montrose's answer here and balpha's answer here. –  Pops May 28 '12 at 19:52

2 Answers 2

I believe that the reason for this is because it's accessing HTML5 LocalStorage. Details are available in the blog post. But basically, it's using JavaScript to check for other valid logins, so it can't be done Server Side.

I'm not 100% clear on this however... But this is why I believe this. From the blog post:

So, we gave up on using third-party cookies. Instead, we use HTML 5 Local Storage for global authentication, at our centralized domain stackauth.com. Now, this does require a modern browser, though not unreasonably so: IE8+, Chrome, Safari, FireFox 3.6+, and Opera 10.61+ are all supported.

You can see the following near the top of the HTML source for any StackOverflow page a call to the JavaScript function StackExchange.init, which (I presume, I have not deminified and read the source recently) uses an asynchronous procedure to check if you're logged in and if so, display that message.

This is done because the team didn't want to force the page to refresh, so the message was deemed a better solution.

share|improve this answer

My guess is that the site needs to set cookies, which are required right away given all the Ajax calls. A cookie needs a new http request to be immediately available.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged .