StackOverflow appears to not use asp.net forms authentication cookies anymore (see: http://blog.stackoverflow.com/2009/08/a-few-speed-improvements).

So - my question is - how is stackoverflow keeping users logged in? I know that asp.net supports cookieless sessions - but I thought this was implemented by placing the forms ticket identifier in the URL (which doesn't seem to be the case with the site).

At any rate, I think knowing how this was implemented could be beneficial for a few of the sites I manage.

| improve this question | | | | |
  • Belongs on SO? It's meta, but it's also not. – Hilarious Comedy Pesto Sep 15 '09 at 14:40
  • 3
    Maybe, but I expect if it were asked there without some wording changes it would likely get closed or migrated here. So when if there's some doubt I tend to leave questions alone. If it doesn't get any response here he can always ask it again himself on the other site. – Joel Coehoorn Sep 15 '09 at 14:44
  • Pesto/Joel: yeah - I wavered as to where the best place for this question to go. I did fear that it would be closed/migrated if on SO - so I thought better to ask here first. If nothing happens to it - I will ask on the main site. – rifferte Sep 15 '09 at 14:52

There is a user cookie with 3 values stored in it. I suspect that when the user is authenticated through OpenId, the SO backend creates a ticket (much like typical forms authentication) and the name of the ticket is stored in this cookie instead.

For meta, the cookie is named somuser and is different because meta.stackoverflow.com has access to the cookies from the stackoverflow.com domain, so to differentiate them you need a unique name.


Typical forms authentication cookie value:


New cookie value:


Much shorter, which means every request is smaller in size.

| improve this answer | | | | |
  • interesting - so you think they implemented their own forms module to work in this manner and override the default behavior? – rifferte Sep 15 '09 at 15:31
  • 1
    That's my assumption, only the SO developers would be able to verify that for sure – John Rasch Sep 15 '09 at 15:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .