How does StackOverflow handle sessions?

Question

I thought that my browser had to send a shared secret with every request. But after looking at the network inspector of Chrome, that seems not to be the case.

The secret seems to be stored in Local Storage as se:fkey (the format of the key seems to match [a-f0-9]{32},[0-9]{10}). However, I don't see it in the send headers:

How does StackOverflow know who I am?

Neela

There are a number of cookies sent with most requests, for example usr – Goulash

Migrated back. Sorry you lost your votes. – Disjoin

You may find useful information from this answer. – Nickname

Answer 1

With:

1. The only cookie that's used for authentication - acct.
2. The fkey - a token for XSRF protection. See What is the fkey that's present on some pages and what does it do?. It's the value of an input with name="fkey".

Mane