Possible Duplicate:
Why does it says welcome back -user- click here to “refresh page”

TL;DR: This is a technical/programming question, not an off topic question about the Stack Exchange network. I'm interested in what purpose this serves as a security technicality.

This has intrigued me for a while. It is not a question about how to use StackExchange websites, or a support question - I'm interested into the specific technical reasons in why all StackExchange websites log me in after the page loads, requiring a refresh.

I'm talking about this message:

enter image description here

I can't understand why logging me in isn't done server-side, rather than as a message after the page has loaded. It's something I've never noticed on any other website.

Oddly, I don't notice this behaviour on stackoverflow.com - only other websites within the Stack Exchange network.

  • @juergend I am asking for the technical reasons, regarding security and application development. This question fits the scope defined in the faq stackoverflow.com/faq
    – Greg
    Nov 30, 2011 at 15:33
  • 2
    Technical questions belong here as well and this one really reads to me like it's asking about SE specifically. One of the SE developers will be able to give the best answer, IMHO.
    – Adam Lear StaffMod
    Nov 30, 2011 at 16:32
  • See also Kevin Montrose's answer here and balpha's answer here.
    – Pops
    May 28, 2012 at 19:52

2 Answers 2


I believe that the reason for this is because it's accessing HTML5 LocalStorage. Details are available in the blog post. But basically, it's using JavaScript to check for other valid logins, so it can't be done Server Side.

I'm not 100% clear on this however... But this is why I believe this. From the blog post:

So, we gave up on using third-party cookies. Instead, we use HTML 5 Local Storage for global authentication, at our centralized domain stackauth.com. Now, this does require a modern browser, though not unreasonably so: IE8+, Chrome, Safari, FireFox 3.6+, and Opera 10.61+ are all supported.

You can see the following near the top of the HTML source for any StackOverflow page a call to the JavaScript function StackExchange.init, which (I presume, I have not deminified and read the source recently) uses an asynchronous procedure to check if you're logged in and if so, display that message.

This is done because the team didn't want to force the page to refresh, so the message was deemed a better solution.


My guess is that the site needs to set cookies, which are required right away given all the Ajax calls. A cookie needs a new http request to be immediately available.

Not the answer you're looking for? Browse other questions tagged .