What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 131 Stack Exchange communities.

Possible Duplicate:
How does SO's new auto-login feature work?

After logging with an 3rd party account (facebook, google, ...), how does Stack Exchange Network save credentials?

I signed up through an existing facebook account, I tried deleting cookies and cache for stackoverflow.com and refreshed the page to see if still logged in, and indeed I am still logged in.

  • If not by cookies, how are the credentials saved (where)?
  • What information is saved in the browser?
  • No matter if OpenId or Oauth(1 or 2) is used, what information is saved in the database when retrieving the information through those protocols?
share|improve this question

migrated from stackoverflow.com Apr 14 '12 at 19:38

This question came from our site for professional and enthusiast programmers.

marked as duplicate by Arjan, Anna Lear Jun 5 '12 at 21:18

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

    
oh, I see... thank you @Arjan ... I guess the answer is up to date, right? –  w0rldart Apr 15 '12 at 11:16
    
No, the duplicate is not necessarily up to date. But that is how Stack Exchange sites work: to be a library of good questions and answers, we don't want the same thing to be asked multiple times. –  Arjan Apr 15 '12 at 11:33
    
Thank you @Arjan, but in the authorization process no database (MySQL, PostgreeSQL ...) at all? All the information is saved in the client's browser? –  w0rldart Apr 15 '12 at 20:15
1  
If you're thinking about those databases, then Which tools and technologies build the Stack Exchange Network? is a must read. –  Arjan Apr 15 '12 at 20:30
    
wow, thank you for sharing those links –  w0rldart Apr 15 '12 at 20:37

1 Answer 1

It saves them using 2 storage methods: cookies and localStorage (html5), and this is probably what you forgot to delete. Without forgetting some kind of Switching Protocol (ws://sockets)

Also, seems that it's been reinforced, by storing it's own credentials on stackauth.com and on every associated network.


  • If not by cookies, how are the credentials saved (where)?

localStorage (html5)

  • What information is saved in the browser?

some kind of cryptic identifier of you (for SSO)

  • No matter if OpenId or Oauth(1 or 2) is used, what information is saved in the database when retrieving the information through those protocols?

using oauth, anything that you previously have granted.

That's the main motivation of the oauth protocol: you (as user) only have to enter your credentials only once to a protected authorization provider, and then, to have the right of grant (or not) to a third-party app a limited access of your personal information, to finally obtain an access_token; without sharing your credentials over the network again.

Good luck!

share|improve this answer
    
thank you for sharing your knowledge Antonio (gracias xD), what about crossbrowser solutions? because there are people with older browsers, that don't support html5, which log ins the same way –  w0rldart Apr 13 '12 at 7:50
1  
thanks, i'm so glad. Crossbrowser solutions? is another very good question.. Nowadays, you have to implement several ways to store (and fetch) them locally (cookies, localStorage, localDatabase, SharedObject). The application must use one and if it fails, fall back to another. Kind of tricky. For javascript you can take a look at: jstorage.info. o_O –  Antonio Saco Apr 13 '12 at 12:10
    
oh, I see... than it seams that I will have to do some more researching before uploading the new app version with the oauth feature –  w0rldart Apr 13 '12 at 12:39

Not the answer you're looking for? Browse other questions tagged .