I believe single sign-on (SSO) is broken between Stack Overflow and its sister sites (Stack Exchange - Physics, Cryptography, ?).

Remember this used to work before (it was not required to type credentials again).

Can the same be fixed?

For developers to reproduce: I am on Chrome and in incognito mode.

A few additional points:

  1. In addition to the existing statement that I am using incognito and consequently having blocked third-party cookies, I have not whitelisted any Stack Overflow or Stack Exchange sites as indicated here.

Suggested Fixes

  1. The current behaviour appears to be linked to the same-site attribute (currently set to value 'lax', but it requires 'none' to resolve perhaps. However, I am not too sure).

  2. If the samesite attribute cannot have the value none, then perhaps an alternate arrangement to use CORS can be made. For example, the recipient sister site can evaluate the source origin and if it’s confirmed as a valid sister site, include the domain in the response for the Access-Control-Allow-Origin header.



You must log in to answer this question.

Browse other questions tagged .