My old computer broke down a few days ago, so I'm using a laptop until I can get it fixed. As a side effect, I no longer have my usual browser cookies, so I had to log back into Stack Exchange.

While doing so, I noticed that I kept having to log in to every Stack Exchange site I visited — the usual "Welcome back [username], you've been logged in." auto-login banner seemed to be conspicuously missing. In fact, a quick look at the "network" tab in the developer tools suggested that no requests to stackauth.com were being made at all.

Eventually, I decided to dive into the code. Turns out that the code to make the global auth check and bring up the banner is simply:


And, what do you know, running that command from the developer console does auto-log me in. However, the reason this code isn't being run automatically is because it's disabled in the site config (apparently for all SE sites). For example, the page I'm typing this question on has the following config options set:

StackExchange.init( {
    "locale": "en",
    "stackAuthUrl": "https://stackauth.com",
    "serverTime": 1408393334,
    "networkMetaHostname": "meta.stackexchange.com",
    "styleCode": true,
    "enableUserHovercards": true,
    "site": {
        "name": "Meta Stack Exchange",
        "description": "Q&A for meta-discussion of the Stack Exchange family of Q&A websites",
        "isNoticesTabEnabled": true,
        "recaptchaPublicKey": "6LdsB7sSAAAAAAzjgEF_Hd8vXv-C42sa_KyofaGR",
        "recaptchaAudioLang": "en",
        "enableNewTagCreationWarning": false,
        "globalAuthDisabled": true,                // <--- HERE
        "isMetaSite": true,
        "enableSocialMediaInSharePopup": true,
        "useGoogleOAuth2": true
    // etc.

So, apparently, global auto-login has been deliberately disabled for some reason. Why is that, and is there any planned timeline for re-enabling it?

  • 1
    I'm going half-in on the bet that Nick forgot a !. – Tim Stone Aug 18 '14 at 20:43
  • 1
    Good work, Ilmari – Shog9 Aug 18 '14 at 21:02
  • Maybe it became buggy, and it was faster to just disable it. – Shadow Wizard Wearing Mask Aug 18 '14 at 22:01
  • 1
    None of this is disabled intentionally as far as I'm aware. Looking into it. – Adam Lear Aug 18 '14 at 22:16
  • Eh? Running that gives [Error] Blocked a frame with origin "https://stackauth.com" from accessing a frame with origin "http://diy.stackexchange.com". The frame requesting access has a protocol of "https", the frame being accessed has a protocol of "http". Protocols must match. – bjb568 Aug 18 '14 at 23:49
  • @bjb568: Strange, it works for me on Chrome 36.0. Obviously, your browser is being pickier about cross-protocol access. – Ilmari Karonen Aug 18 '14 at 23:54


...and an extra !, but mainly the reasons.

| improve this answer | |
  • 4
    Ah, an extra ! instead of a forgotten one...good thing I only went halfsies. – Tim Stone Aug 19 '14 at 1:05
  • I'm glad you have functional tests in place that get run on rollout. AHEM. There seem to be regression failures more often than desirable. – Lightness Races in Orbit Aug 20 '14 at 15:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .