stackoverflow's user cookie seems to have the form


(the times are sans year, which is a little strange).

I assume the mystery values are some kind of hash or session id, but why are there two of them?

  • 2
    Oh come on! Where's the fun in reverse engineering if you ask! =P
    – Tom Ritter
    Aug 4 '09 at 12:06
  • @Tom Ritter: right, what was I thinking! Good thing nobody who knows answered.
    – ysth
    Aug 5 '09 at 3:00

Ah, after googling muchly, I think these may be series and token identifiers, as described in http://jaspan.com/improved_persistent_login_cookie_best_practice.

Each is a base64-encoded 128-bit (presumably random) number, with the trailing == removed.

  • My guess that s stand for secret. (the series id for uses is the user id). May 21 '10 at 23:07
  • @Mendy: I don't think so; the whole point of having a distinct series token is that it is secret, preventing a would-be DOS attacker from submitting invalid login cookies for many users and thus invalidating their cookies.
    – ysth
    Aug 24 '10 at 22:48

I think that it is broken into 3 sections. UserID/Session|Stats|Login Time.

My Guess is that the first one is the Session Key that pertains to the user, and the second one might be to distinguish sessions from different computers or a tracking key.

I could be wrong on my first guess, and it might be that it is UserID|Preferences|LoginTime if StackOverflow they have chosen to keep some preferences stored in the cookie, so it doesn't have to store any data in a PHP Session-Like (I know it runs on ASP) system, and then just goes and grabs the rep everytime.

Then again, I could be wrong on my second guess too.

  • Best way to test this would be to see what makes the value change. Aug 4 '09 at 5:30
  • sounds like your cookie looks completely different than mine? you have no s= or t=?
    – ysth
    Aug 4 '09 at 6:13
  • I have the s and t, I just am grouping each segment by the | bars, because most likely they are grouped for a reason. Aug 4 '09 at 6:26
  • I don't see your 3 sections. Each of my s and t are in two sections, divided by |. Before the | is a what looks like a base64 string (except that it's 22 characters, not a valid base64 length) of alphanumeric, /, and + characters. After the | is a MM-DD HH:MM:SS timestamp.
    – ysth
    Aug 4 '09 at 7:26
  • Notice that there are 2 bars, the first one is the first 'section', with the t= and stuff. The part after the first bar is the second one, with the s= and stuff. The third is the login time. Aug 4 '09 at 15:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .