1

When logging in with email address and password on one site (Community), then sometimes I'm also logged in to other sites I had visited before, while for other sites I have to repeat the log-in.

Communities example

I had been asked whether those communities are the same domain; well, it's hard to tell from the list shown to the user. (BTW: The list of "your communities" is not complete)

Is that the way it should be?

When I use Google to authenticate, the omnipresence of Google just makes it work. I'm also using Firefox, and https://meta.stackoverflow.com/a/284697/6607497 is almost 8 years old now.

4
  • 4
    This feels like a question for Meta Stack Exchange, not Stack Overflow's Meta.
    – Thom A
    Commented Jan 3 at 20:56
  • 1
    usually, when i click "login" on other sites while logged in on SO, it just skips the email/password and logs me in directly.
    – Kevin B
    Commented Jan 3 at 21:32
  • 1
    Sites have to be the same domain for multi-site login to work. Are the ones you're trying the same domain? Commented Jan 3 at 21:57
  • 1
    Can't there be a single "auth-provider" that other sites trust and use? I mean all under one authority. Having to log-in to multiple servers reminds me of HP in the 90ies...
    – U. Windl
    Commented Jan 3 at 22:27

1 Answer 1

5

The top-level domain (TLD) matters.

You'll have to authenticate in each top-level domain, aka stackoverflow.com, severfault.com, superuser.com, mathoverflow.com, askubuntu.com, stackapps.com and stackexchange.com once and from there Universal Login will log you in on any other site under that same TLD.

This used to work across all domains owned by SE, but security and privacy concerns made that stricter handling of cookies by the major browsers broke that functionality. I explain that in my answer on Did something change with Stack Exchange's cross-domain login process? (no longer working) and I'll quote Yaakov from their answer for any chance on fixing the behavior:

We can't think of things we can do to alleviate this short of completely changing the way that we handle cross-domain auth (and only if we can find a way to do so that will not run into the same browser issues that we are running into now).

So based on your screenshot I crafted this table:

Community TLD Universal login for domains
Stack Overflow stackoverflow.com meta and main of Stack Overflow
Unix & Linux unix.stackexchange.com all sites under *.stackexchange.com
Super User superuser.com meta and main of Super User
Tex & Latex tex.stackexchange.com all sites under *.stackexchange.com
Meta Stack Exchange meta.stackexchange.com all sites under *.stackexchange.com

If you're logged out everywhere and then login in again I expect you to have at least authenticate 3 times for your communities. Note that there are other factors that might require re-authenticating, like expiring of cookies or server side reset of your session. There are several reports from users that have their sessions invalidated rather often, but so far I haven't seen a common reason / reliable reproduction or confirmation from SE staff what causes these invalidations.

In the comments you asked:

Can't there be a single "auth-provider" that other sites trust and use?

Well, Stack Exchange did have that. It was an OpenID server, but somehow that service wasn't used to replace Global Auth, instead the whole OpenID server got sunsetted in 2018: Support for OpenID ended on July 25, 2018

2
  • I think it's rather interesting that the "Universal Login" is restricted to one DNS domain (server). What's universal about it then? Isn't it a plain site login, then? -- Actually I'm afraid that most users do not care, because they use some external authentication provider (Like Google). -- Maybe my question should have been as simple as "Why does single-sign-on work nicely with (e.g.) Google (e.g.), but not for SE?"
    – U. Windl
    Commented Jan 8 at 8:25
  • @U.Windl the answer would still be: [Universal Login] used to work across all domains owned by SE, but security and privacy concerns made that stricter handling of cookies by the major browsers broke that functionality.. You're free to dislike that today, but I'm not sure that they could have foreshadowed this breakage back in 2015. I'll give you that if they sticked with/ expanded use of their server for OpenId and/or added OpenIdConnect ; oAuth they woulldn't have been in this mess today. Hindsight makes things easy.
    – rene
    Commented Jan 8 at 9:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .