11

Here's what I did:

  1. Completely cleared my browser of all cookies
  2. Open a new browser window in Incognito mode
  3. Navigate to askubuntu.com and log in
  4. Open a new tab and navigate to stackoverflow.com

On its first response, Stack Overflow responds with my user profile photo already populated and my notifications in place!

How did Stack Overflow know that I was logged in to the network? Any cookies set by Ask Ubuntu should not have been accessible (from what I understand) to Stack Overflow – a different domain!

Note: This is not a duplicate of "Global auth is dead! Long live universal login", which is a progress update that does not go into specifics at all. I am looking at least for a bare bones technical explanation.

20

Once you get authenticated on a single site, the full.js gets loaded, which has a function UniversalAuth.performAuth() which gets called.

That function starts with an XMLHttpRequest POST to /users/login/universal/request of the current domain. It doesn't take parameters but the browser does send all the cookies it has collected, including prov, _uauth and acct.

That API returns an JSON Array with for each site a host, token and nonce attribute:

[{
        "Token": "cF/S4H",
        "Nonce": "2CJTWw",
        "Host": "stackexchange.com"
    }, {
        "Token": "42",
        "Nonce": "4242",
        "Host": "serverfault.com"
    }, {
        "Token": "4242424",
        "Nonce": "42",
        "Host": "superuser.com"
    }, {
        "Token": "42424242",
        "Nonce": "4242",
        "Host": "askubuntu.com"
    }, {
        "Token": "424242",
        "Nonce": "4242424",
        "Host": "stackapps.com"
    }, {
        "Token": "42424242424",
        "Nonce": "4242424242424242",
        "Host": "mathoverflow.net"
    }
]

That response is iterated and for each element it creates an image tag with this url:

 var url = '//' + group.Host + 
 '/users/login/universal.gif?authToken=' + encodeURIComponent(group.Token) + 
 '&nonce=' + encodeURIComponent(group.Nonce);

Once the src attribute of the image is set it gets loaded:

 var $img = $('<img/>').attr({
    style: 'display:none',
    src: url,
    'crossOrigin': 'use-credentials'  // needed for CORS
  });

So suppose we're currently on stackoverflow.com. For the above code the img tag and its src attribute for the serverfault.com will look like:

<img src="https://serverfault.com/users/login/universal.gif?authToken=42&nonce=4242" />

You browser will now send that src url to the site serverfault.com, (the site you're currently not on!) and on the response of that image two cookies are returned for that specific domain (serverfault.com): provand acct. Those two new cookies are are now bound and will be used for the domain serverfault.com

Rinse and repeat for the other hosts.

When you later switch to serverfault.com, say to https://serverfault.com/questions your browser will send the cookies prov and acct that you received earlier when performAuth() loaded the universal.gif image from serverfault.com at the moment you logged in on stackoverflow.com.

When serverfault.com receives the prov and acct cookies the server side code looks their values up in the list of valid account cookies and if the database has those on record, a link to your profile id is established. The executing code will then conclude you have logged in before and as a result will return a page that is already authenticated. You are logged in.

You can verify above process by opening your browser and the developer console and then keep an eye on the network tab while you're logging in on one site.

  • Thanks for the detailed answer. But how does the next SE site you visit obtain the cookies from a previous SE site you visited? – CodyBugstein Jul 22 '18 at 3:47
  • 2
    @CodyBugstein your browser will send them because they received them esrlier on the response of fetching the universal.gif image. I expanded my answer a bit to explain this better. – rene Jul 22 '18 at 6:44
  • 1
    thanks for the amazing explanation. One more question; how did you figure all this out? – CodyBugstein Jul 22 '18 at 21:17
  • This is a pretty clever hack sort of thing. – TheWanderer Oct 4 at 21:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .