Back in 2015, we announced a redesign of the login system. It's been running for a few months now and seems to be doing alright.
When you log in, we issue a cookie for the second-level domain of the site you're logging into. If you only ever visit the sites based off of stackexchange.com, there's nothing special here. It's just that the auth cookie has
.stackexchange.com as its domain, so it's accessible on all sites that share it. (Previously, each site set its own cookie at its own subdomain.)
Things get a bit more interesting when we want to log someone in on stackexchange.com and stackoverflow.com and serverfault.com, etc. We have seven of such domains in total.
If we were Google or a similarly large site, this would possibly be easier. They can afford to bounce you through several domains during sign-in (which is how you end up logged into, say, Gmail and Youtube at the same time) without a substantial performance penalty. We don't have that luxury. Our data centers are too far away from a lot of our users to provide a not-massively-annoying sign-in experience. So we do the next best thing - issue an "image" request to other domains. This request includes validation measures to prevent random/malicious requests from bad actors, but ultimately it is just an attempt to load a 1px transparent .gif that actually comes back with a
Set-Cookie header. If the request is validated, we set the auth cookie on the domain that did the validation... effectively logging you in there.
This doesn't work in a few cases - in Safari (which rejects all third-party cookies no matter what), or if the user explicitly disables third-party cookies. It also doesn't work for Area 51 despite it sharing the domain with a bunch of Q&A sites. This is because A51 is a completely separate codebase that doesn't have direct access to the database that keeps track of the account sessions. I have some ideas on how we could make the sign-in experience there more seamless, but I need to set some time free to try them out and see what happens.
Anyway, that's about it. Hope this helps; let me know if there's anything you'd like me to elaborate more on.