How does SO's new auto-login feature work?

The above link talks about how auto login is implemented in SO. Answer to that post points to this solution.

Is there a new auto-login feature?

Now in 2016, if i access another SO site after logging into one, we get logged into the second site immediately without any page refresh.

I am curious to know how this "without any page refresh" login thing work.

  • This is announced here: "When you log into any Q&A site on the stackexchange.com domain, you will be automatically logged into all other Q&A sites on the stackexchange.com domain + stackexchange.com itself" - however, it does not explain the "how" part, so leaving this open in hope it will be explained. – Shadow Wizard Wearing Mask Jun 2 '16 at 5:50

Back in 2015, we announced a redesign of the login system. It's been running for a few months now and seems to be doing alright.

When you log in, we issue a cookie for the second-level domain of the site you're logging into. If you only ever visit the sites based off of stackexchange.com, there's nothing special here. It's just that the auth cookie has .stackexchange.com as its domain, so it's accessible on all sites that share it. (Previously, each site set its own cookie at its own subdomain.)

Things get a bit more interesting when we want to log someone in on stackexchange.com and stackoverflow.com and serverfault.com, etc. We have seven of such domains in total.

If we were Google or a similarly large site, this would possibly be easier. They can afford to bounce you through several domains during sign-in (which is how you end up logged into, say, Gmail and Youtube at the same time) without a substantial performance penalty. We don't have that luxury. Our data centers are too far away from a lot of our users to provide a not-massively-annoying sign-in experience. So we do the next best thing - issue an "image" request to other domains. This request includes validation measures to prevent random/malicious requests from bad actors, but ultimately it is just an attempt to load a 1px transparent .gif that actually comes back with a Set-Cookie header. If the request is validated, we set the auth cookie on the domain that did the validation... effectively logging you in there.

This doesn't work in a few cases - in Safari (which rejects all third-party cookies no matter what), or if the user explicitly disables third-party cookies. It also doesn't work for Area 51 despite it sharing the domain with a bunch of Q&A sites. This is because A51 is a completely separate codebase that doesn't have direct access to the database that keeps track of the account sessions. I have some ideas on how we could make the sign-in experience there more seamless, but I need to set some time free to try them out and see what happens.

Anyway, that's about it. Hope this helps; let me know if there's anything you'd like me to elaborate more on.

| improve this answer | |
  • 6 years ago, Kevin said "A browser as popular as Safari just plain not working with any third-party cookie scheme just kills the entire technology for us." So what changed there? Do you just view the % of Safari users as negligible now? meta.stackexchange.com/a/64274/161554 – andrewtweber Jan 5 '17 at 21:28
  • 1
    @andrewtweber Yes and no. I don't know what the % was six years ago, but when we looked at it again, the pros of this approach (such as allowing us to support SSL - we need to move meta sites to *.meta.stackexchange.com, so the old "meta sites have access to the parent site's cookie" scheme wouldn't work either) outweigh the potential inconvenience to Safari visitors and anyone else who deliberately turns off third-party cookies. A common case is still "log in once, log into all *.stackexchange.com" sites, and most people don't have accounts on all SLDs we have. – Adam Lear Jan 5 '17 at 22:08
  • Ah that's true, at most they have the inconvenience of logging into ~5 domains now instead of 100. That makes sense. Thanks! – andrewtweber Jan 5 '17 at 22:12
  • I use Safari, and I just posted meta.stackoverflow.com/questions/361041/… on this. ODDLY, when I went to Travel after, it DID log me in again! Since third-party cookies are a rather obnoxious tracking method, I suspect that could easily be stated "outweigh the potential inconvenience to a heck of a lot of people." – WGroleau Dec 23 '17 at 16:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .