I am trying to build something similar to Stack Overflow's authentication system (Authlogic Connect, rubygem) and I'm using Oauth. When I logout and try to log back in through Google (testing the gem), it gives me a new token, so if I've stored the previous token in the database, it doesn't matter because the new one doesn't match. That means I can't find the user. Same thing happens if I do it with twitter and revoke access: twitter gives me a new token and I can't find the user in the database.

So how is stack overflow doing it?

Are you just getting the email address from the authentication provider, and finding the user by that?

Thanks for the tips,


1 Answer 1


The Stack Overflow family sites (SOFU sites) are not asking the OpenID provider to authenticate you each time you visit the site. Instead, after delegating authentication to OpenID once, the sites set their own cookies to remember you, which are kept for a long time, unless you log out yourself. (I guess the tokens are not even stored.)

After a logout, the next time an OpenID authentication is required, the sites only need to know your OpenID id to start authentication again. So, the SOFU sites do store your OpenID id.

(Note that OAuth and OpenID are different things. OAuth is used to authorize 3rd party software to access some application on your behalf, and then that software passes the token for each request. Indeed, the application should then verify that the token is still valid. OpenID is used to authenticate a human being, and after authentication the application should still decide what actions are authorized, and can do whatever to remember the user. The SOFU sites use a cookie for the latter.)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .