Possible Duplicate:

TL;DR: This is a technical/programming question, not an off topic question about the Stack Exchange network. I'm interested in what purpose this serves as a security technicality.

This has intrigued me for a while. It is not a question about how to use StackExchange websites, or a support question - I'm interested into the specific technical reasons in why all StackExchange websites log me in after the page loads, requiring a refresh.

I'm talking about this message:

enter image description here

I can't understand why logging me in isn't done server-side, rather than as a message after the page has loaded. It's something I've never noticed on any other website.

Oddly, I don't notice this behaviour on stackoverflow.com - only other websites within the Stack Exchange network.

share|improve this question
@juergend I am asking for the technical reasons, regarding security and application development. This question fits the scope defined in the faq stackoverflow.com/faq –  Greg Nov 30 '11 at 15:33
Technical questions belong here as well and this one really reads to me like it's asking about SE specifically. One of the SE developers will be able to give the best answer, IMHO. –  Anna Lear Nov 30 '11 at 16:32
See also Kevin Montrose's answer here and balpha's answer here. –  Pops May 28 '12 at 19:52
add comment

migrated from stackoverflow.com Nov 30 '11 at 16:07

This question came from our site for professional and enthusiast programmers.

marked as duplicate by balpha Nov 30 '11 at 19:00


2 Answers

I believe that the reason for this is because it's accessing HTML5 LocalStorage. Details are available in the blog post. But basically, it's using JavaScript to check for other valid logins, so it can't be done Server Side.

I'm not 100% clear on this however... But this is why I believe this. From the blog post:


You can see the following near the top of the HTML source for any StackOverflow page a call to the JavaScript function StackExchange.init, which (I presume, I have not deminified and read the source recently) uses an asynchronous procedure to check if you're logged in and if so, display that message.

This is done because the team didn't want to force the page to refresh, so the message was deemed a better solution.

share|improve this answer
add comment

My guess is that the site needs to set cookies, which are required right away given all the Ajax calls. A cookie needs a new http request to be immediately available.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged .