0

stackoverflow's user cookie seems to have the form

t=<mystery-value>|<last-access-time>&s=<mystery-value>|<login-time>

(the times are sans year, which is a little strange).

I assume the mystery values are some kind of hash or session id, but why are there two of them?

Improve this question
2
  • 2
    Oh come on! Where's the fun in reverse engineering if you ask! =P – Tom Ritter Aug 4 '09 at 12:06
  • @Tom Ritter: right, what was I thinking! Good thing nobody who knows answered. – ysth Aug 5 '09 at 3:00
2

Ah, after googling muchly, I think these may be series and token identifiers, as described in http://jaspan.com/improved_persistent_login_cookie_best_practice.

Each is a base64-encoded 128-bit (presumably random) number, with the trailing == removed.

Improve this answer
2
  • My guess that s stand for secret. (the series id for uses is the user id). – Fitzchak Yitzchaki May 21 '10 at 23:07
  • @Mendy: I don't think so; the whole point of having a distinct series token is that it is secret, preventing a would-be DOS attacker from submitting invalid login cookies for many users and thus invalidating their cookies. – ysth Aug 24 '10 at 22:48
0

I think that it is broken into 3 sections. UserID/Session|Stats|Login Time.

My Guess is that the first one is the Session Key that pertains to the user, and the second one might be to distinguish sessions from different computers or a tracking key.

I could be wrong on my first guess, and it might be that it is UserID|Preferences|LoginTime if StackOverflow they have chosen to keep some preferences stored in the cookie, so it doesn't have to store any data in a PHP Session-Like (I know it runs on ASP) system, and then just goes and grabs the rep everytime.

Then again, I could be wrong on my second guess too.

Improve this answer
5
  • Best way to test this would be to see what makes the value change. – Tyler Carter Aug 4 '09 at 5:30
  • sounds like your cookie looks completely different than mine? you have no s= or t=? – ysth Aug 4 '09 at 6:13
  • I have the s and t, I just am grouping each segment by the | bars, because most likely they are grouped for a reason. – Tyler Carter Aug 4 '09 at 6:26
  • I don't see your 3 sections. Each of my s and t are in two sections, divided by |. Before the | is a what looks like a base64 string (except that it's 22 characters, not a valid base64 length) of alphanumeric, /, and + characters. After the | is a MM-DD HH:MM:SS timestamp. – ysth Aug 4 '09 at 7:26
  • Notice that there are 2 bars, the first one is the first 'section', with the t= and stuff. The part after the first bar is the second one, with the s= and stuff. The third is the login time. – Tyler Carter Aug 4 '09 at 15:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .