2

I am active in a handful of sites like superuser and stack overflow. When I find time to come here, I often work on several questions or answers.

I was always annoyed that I can log out all my communities at once, but cannot log in the same way. Today I found by chance why there is no instruction to set this up: Because it should happen automatically. (Why am I requested to log in again before I can post a question even though I have logged in)

Quote:

And, once you login to any Stack Exchange community, you are automatically logged in to all the communities that you have ever joined — in that browser session.

Now that sounds so good; I want that too please.

I am working on different computers like a sys-admin, mainly using Firefox but also Chrome and MS Edge or whatever browser I find where I need to work. Never has my login worked automagically accross Stack Exchance sites. It might not be a browser problem.

I am always logging in to each site by the same e-mail address and the same pw. I believe all those "accounts" are together, because I have something like a "combined inbox" for messages and the same user-photo is showing in the top-bars.

Where can I look up the configuration for this please? Normally I allow cookies for each session and only have them swiped when I close a browser.

4
  • 1
    Do you allow third-party cookies in all those browsers?
    – rene
    Commented Feb 3, 2018 at 15:09
  • I've popped in a related question on MSE - but I might see if I can mug someone from the SE staff if there isn't a reply to either in a day or two. You're probably going to need a dev looking at things to sort this out. This is an appropriate place, so no worries.
    – Journeyman Geek Mod
    Commented Feb 4, 2018 at 0:45
  • @rene No, I never allow third-party cookies normally. If a website wants to use cookies, I would prefer them to use their own domain. But since you asked that question, I just tried - and guess what: It works now. I can pull all my exchanges from that top-right icon and open a new tab for each and I AM logged in. Awesome. Please write this an answer, so that it will help other users and you get the bonus. I would want to see where all these third-party-cookies are coming from, so that I can whitelist them, rather than allowing all sorts of zombie cookies into my browsers.
    – Martin Zaske
    Commented Feb 5, 2018 at 11:49
  • @JourneymanGeek Please see my other comment: I believe this issue is almost settled. But thank you very much for your help.
    – Martin Zaske
    Commented Feb 5, 2018 at 11:51

1 Answer 1

Reset to default
2

There is no magic. For cross-site login to work there is some clever JavaScript executed in your browser once you are logged in on one site. That JavaScript loads an image for each second-level domain (like stackoverflow.com, serverfault.com, etc) and in the response of that GET each site delivers its authentication cookies.

As those cookies are coming from a different domain (a so called third-party cookie) your browser needs to be configured to accept those cookies (and you need to use a decent browser, aka not Safari).

From Adam Lear, SE developer If you have third-party cookies disabled and end up logging in on another second-level domain, that new session should get linked up with the one for whatever other domain you were already logged into. That way if you go to log out later, the sessions for all domains will be invalidated at the same time.

If you're a member of only sites that are on *.stackexchange.com you wouldn't have this issue. Only due to having customized dns names for some sites, the universal login has to deal with those third-party cookies.

I didn't verify but I assume the developer console of the major browsers might raise warnings when cookies are dropped but at least you can observe the behavior I described.

5
  • I can confirm that allowing the third-party cookies, solved my posted problem. Is this question + good answer sufficient, or should we somehow get this into the SE documentation. I had searched for something before posting my question, and did not find a write-up, so adding it, might be a good thing. I leave this to the veterans with the knowledge and the authority to touch the documentation. Thanks rene.
    – Martin Zaske
    Commented Feb 5, 2018 at 13:27
  • I pinged a developer to confirm I got it right or that I missed some important nuance.
    – rene
    Commented Feb 5, 2018 at 13:40
  • 1
    @rene Yeah, this is correct. The only thing I'd add purely for completeness' sake is that, if you have third-party cookies disabled and end up logging in on another second-level domain, that new session should get linked up with the one for whatever other domain you were already logged into. That way if you go to log out later, the sessions for all domains will be invalidated at the same time.
    – Adam Lear StaffMod
    Commented Feb 5, 2018 at 19:07
  • @AdamLear thanks, I've edited that in. I never looked at the logout flow but your comment raised my interest and will certainly revisit that to see it in action under the browser hood. Exciting capabilities.
    – rene
    Commented Feb 5, 2018 at 19:24
  • 1
    @rene There's not much to it. Same requests go out, but behind the scenes we check if there's an existing session and issue the same GUID that links the per-domain sessions together. Or at least that's how I believe we implemented it and I hope it actually works. :)
    – Adam Lear StaffMod
    Commented Feb 5, 2018 at 19:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .