2

I am trying to understand how websites implement in-browser account switcher.

e.g you can login to twitter using multiple accounts. On the bottom left when you click your currently logged in account, if you have multiple accounts, you can see them all and simply switch by clicking a different one.

How does this work? Typically, once you login, you get a session cookie. So each time you visit twitter this cookie gets sent over automatically. But in case of multiple accounts, how does the browser store these two separate cookies for the same domain ?

Is it in the same cookie ? If so, isn't that a security risk ? How does the web app switch the user session ?

I checked local/session storage and both have same data for twitter dot com. Twitter also uses Authorization header but the value is same for both accounts.

So now im kinda bummed out tryng to figure out how account switching works.

Improve this question

1 Answer 1

Reset to default
0

I'm not sure how it works in your specific case but you are asking about a more general case anyway.

The basic problem you seem to have that you could not understand how a single cookie/token could be used with multiple users. But a cookie/token does not need to contain any actual user related information in the first place, it can just be a key which points to these information at the server side. And which information are currently associated with this key are fully controlled by the server.

A simple implementation could thus keep the current session state (which includes which users are logged in) at the server side and only associate it with the current/token. When receiving the cookie/token the server simply looks up the associated information, i.e. if it is valid at all and which user is currently associated with it. When switching the user simply different information would be associated with the same cookie/token.

Improve this answer
2
  • right. so the cookie, after the second user logs in, will be something like "id1, id2 current_user=id1" so now when I click change_user and switch to user 2, what piece of code will let the server know that the current_user is id2? in case of twitter, in the cookie, i see different auth_token for the different users, but not at the same time, only after i switch the users.
    – InsatiableTraveller
    Dec 2, 2020 at 6:21
  • @InsatiableTraveller: Again, the client-side visible cookie does not need to include the user as information. It only needs to be some key which allows the server to look up the actual information. And what is stored behind this key can change, without any kind of reflection on the client side.
    – Steffen Ullrich
    Dec 2, 2020 at 6:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .