Single sign-on (SSO) between Stack Overflow and Stack Exchange (e.g., Physics and Cryptography) is broken

Ask Question

Asked 21 days ago

Modified 20 days ago

Viewed 100 times

-9

I believe single sign-on (SSO) is broken between Stack Overflow and its sister sites (Stack Exchange - Physics, Cryptography, ?).

Remember this used to work before (it was not required to type credentials again).

Can the same be fixed?

For developers to reproduce: I am on Chrome and in incognito mode.

A few additional points:

In addition to the existing statement that I am using incognito and consequently having blocked third-party cookies, I have not whitelisted any Stack Overflow or Stack Exchange sites as indicated here.

Suggested Fixes

The current behaviour appears to be linked to the same-site attribute (currently set to value 'lax', but it requires 'none' to resolve perhaps. However, I am not too sure).
If the samesite attribute cannot have the value none, then perhaps an alternate arrangement to use CORS can be made. For example, the recipient sister site can evaluate the source origin and if it’s confirmed as a valid sister site, include the domain in the response for the Access-Control-Allow-Origin header.

edited Jun 13 at 13:25

This_is_NOT_a_forum

6,6704 gold badges34 silver badges55 bronze badges

asked Jun 12 at 10:25

Ravindra HV

1715 bronze badges

2

Bug report must contain details. You just say "broken" without giving any actual details. And no, it's not "broken" as it works for millions of users. (Guessing you mean log into the sites.)
– Shadow Wizard Says No More War
Jun 12 at 11:01
6

You probably have "Block third-party cookies in Incognito" enabled under chrome://settings/cookies.
– 41686d6564 stands w. Palestine
Jun 12 at 11:06
2

Does this answer your question? Can Stack Overflow implement single sign on for its all sites? (specific answer) or meta.stackexchange.com/q/322184/282094
– Rob
Jun 12 at 11:37
@41686d6564standsw.Palestine - Yes. That is the default is it not?
– Ravindra HV
Jun 12 at 12:17
@Rob - So what would be the 'parent' site for physics and crypography sites?
– Ravindra HV
Jun 12 at 12:18
@RavindraHV Yes, it has been for about 1-2 years now.
– 41686d6564 stands w. Palestine
Jun 12 at 12:18
@41686d6564standsw.Palestine - Guess so. Thought would post since no one else seemed to be bothered. In case I missed it, is it mentioned anywhere that stackoverflow / stackeexchange SSO requires 3rd party cookies to be enabled to work?
– Ravindra HV
Jun 12 at 12:21
1

Did something change with Stack Exchange's cross-domain login process? (no longer working)
– 41686d6564 stands w. Palestine
Jun 12 at 12:25
@41686d6564standsw.Palestine - Perhaps the same-site behaviour is the answer. In any case I have not whitelisted any stack-exchange sites so that is there as well. Guess with 3rd party cookies blocked.. there is not much that can be done.... unless perhaps an ajax call can be made through enabling CORS and also take a look at Access-Control-Allow-Origin... but that is a policy call so not sure if its a viable one...
– Ravindra HV
Jun 12 at 13:18
7

This can be fixed by you stop to browse incognito or not to block 3rd party cookies. SE isn't broken, your set-up is.
– Luuklag
Jun 12 at 14:10
Related: Which browsers are officially supported? And what else do I need?. It contains input for JavaScript allowlisting, cookies, etc.
– This_is_NOT_a_forum
Jun 13 at 13:25

Add a comment |

Stack Exchange Network

current community

your communities

more stack exchange communities

Single sign-on (SSO) between Stack Overflow and Stack Exchange (e.g., Physics and Cryptography) is broken

0

You must log in to answer this question.

Browse other questions tagged bug linked-accounts .

Linked

Hot Network Questions

Single sign-on (SSO) between Stack Overflow and Stack Exchange (e.g., Physics and Cryptography) is broken

0

You must log in to answer this question.

Browse other questions tagged bug linked-accounts .

Linked

Related

Hot Network Questions