What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 128 Stack Exchange communities.

Hi,

I have encountered strange OpenID authentication problem today. I have been using Google ID as my openID provider for Stackoverflow.

Problem:

  • I have enabled remember my password for SO and meta.
  • happended to change my google password(gmail) in a different machine (last night from home)
  • When i open SO today morning in my office machine, it just let me in. Eventhough the password is changed.

is this correct behaviour??

Cheers

share|improve this question
    
For some more insight, nut for a different issue, see also "Why am I stilled logged into Gmail AND StackOverflow after logging out of StackOverflow?" at meta.stackexchange.com/questions/41094/… –  Arjan Mar 4 '10 at 9:57
add comment

2 Answers 2

up vote 3 down vote accepted

Yes, this is the correct behaviour.

SO and Meta are really not remembering your password. They don't even know your password. They just remember you were once authenticated by some third party that you trust.

(Whenever a login is required --which, however, is not the case in your situation-- then all is delegated to your OpenID provider. Even then, that provider knows it's you that changed the password, so maybe the OpenID provider wouldn't prompt you for a confirmation either and just tell the site you're authenticated again.)

share|improve this answer
add comment

Because cookies are saved at your office computer, which is under stackoverflow.com domain.

When you browse stackoverflow.com, browser send existing cookies to Stack Overflow server, and server just check those are valid or not against its own database, not to the Google.

So, in your case, its just normal behavior.

share|improve this answer
    
yeah i know that mark, but it feels not good. This is related to security.. i felt its just bad to let me in with the old credential after changing my password... –  RameshVel Mar 4 '10 at 9:44
    
Don't worry, even your session in stackoverflow.com domain leaks to somewhere else, it does not effect your google account. they are different sessions, open id just generate a seperate session for stackoverflow.com, which is per domain based –  YOU Mar 4 '10 at 9:48
    
@Ramesh, no it's not using the old credentials. It doesn't even know the credentials, as you only typed those on the site of the OpenID provider. SO and Meta are just remembering that they know it was you yesterday, and given the cookie assume it's still you today. –  Arjan Mar 4 '10 at 9:50
add comment

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .