Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 157 Stack Exchange communities.

What is meta?
Here's how it works:
  1. Any Stack Exchange user can ask a question
  2. The community provides support, votes on ideas, and reports bugs
  3. Your voice helps shape the way Stack Exchange operates


I have encountered strange OpenID authentication problem today. I have been using Google ID as my openID provider for Stackoverflow.


  • I have enabled remember my password for SO and meta.
  • happended to change my google password(gmail) in a different machine (last night from home)
  • When i open SO today morning in my office machine, it just let me in. Eventhough the password is changed.

is this correct behaviour??


share|improve this question
For some more insight, nut for a different issue, see also "Why am I stilled logged into Gmail AND StackOverflow after logging out of StackOverflow?" at… – Arjan Mar 4 '10 at 9:57
up vote 3 down vote accepted

Yes, this is the correct behaviour.

SO and Meta are really not remembering your password. They don't even know your password. They just remember you were once authenticated by some third party that you trust.

(Whenever a login is required --which, however, is not the case in your situation-- then all is delegated to your OpenID provider. Even then, that provider knows it's you that changed the password, so maybe the OpenID provider wouldn't prompt you for a confirmation either and just tell the site you're authenticated again.)

share|improve this answer

Because cookies are saved at your office computer, which is under domain.

When you browse, browser send existing cookies to Stack Overflow server, and server just check those are valid or not against its own database, not to the Google.

So, in your case, its just normal behavior.

share|improve this answer
yeah i know that mark, but it feels not good. This is related to security.. i felt its just bad to let me in with the old credential after changing my password... – RameshVel Mar 4 '10 at 9:44
Don't worry, even your session in domain leaks to somewhere else, it does not effect your google account. they are different sessions, open id just generate a seperate session for, which is per domain based – YOU Mar 4 '10 at 9:48
@Ramesh, no it's not using the old credentials. It doesn't even know the credentials, as you only typed those on the site of the OpenID provider. SO and Meta are just remembering that they know it was you yesterday, and given the cookie assume it's still you today. – Arjan Mar 4 '10 at 9:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .