I'm developing a website for a group of people who play a game online. (It's for a mmorpg guild). I'm creating it all myself rather than using an existing system mostly to learn website skills as I'm a c++ programmer.

It has some features that people will need to log in to use such as messages, chat and so on. I will certainly require the user to be logged in to get any access to those.

It also has some functionality that need to know the user asking for the information but there are no security implications at all as the information is entirely public anyway for example displaying stats for how the player is doing in game. Anyone could go look them up elsewhere so I only need to know who to display them for, not to authenticate.

My intention is to keep the user in a cookie or something so at all times the website will know who is asking for the information even if they are not logged on. (For privacy reasons I'll let people turn this ability on and off - defaulting it to off)

My question is, is this a bad user experience? Will it lead to confusion amongst users? That the website already seems to know who the user is and some of it works. But other parts need the user to log on first even though to a user it might seem it already knew who they were.

Basically after thinking about this for a while, I no longer have any idea if this would seem confusing or not any more to some random user.

  • Actually, Amazon does exactly what you talk about. It keeps you identified (as shown by the "Not ....?" link, but still requires you to log in before you can make a purchase. But when I log out, the "Not ....?" link becomes "Login". What I don't like is they do it without asking for consent. May 16, 2013 at 16:20
  • I think I've decided not to do this. I might have a "stay logged on" option but I think this is confusing and might have security/privacy issues in the future as features get added. But thank you for the answers
    – jcoder
    May 16, 2013 at 16:49

2 Answers 2


I will not talk about the security issue here.

If the user is explicitly asking the website to remember their username it is not bad UX, on the contrary it is good UX that the website is offering such a service. Since people use different IDs in different games and this feature saves them the trouble of remembering the ID all the time. They can associate their password with their visible ID and log in.

It is a standard practice in many online games and many websites provide the same feature.

Gmail login
enter image description here

Not embedding other images on purpose.

Facebook login (look at the top bar)

League of legends login screen

World of warcraft login screen


Keeping someone logged in should be under control of that someone. When I log out, I expect a site to forget that I was logged in. In other words, it is not bad UX to ask for consent. It is bad UX not to ask for consent.

Even with I have given explicit consent to keep me signed in, when I do log out, I expect to be logged out and cookies by which I am identified to be removed (unless it is only to remember the user name I used and I have given consent to remember my user name).

Please bear in mind that many computers are used by multiple individuals and keeping someone logged or even identified without their consent is not just a security risk, but a privacy issue as well.

  • Indeed that's why I said it would default to "off". I agree entirely that the user needs to understand what they have agreed to.
    – jcoder
    May 16, 2013 at 16:17
  • @jcoder: Yes, rereading your question I see that. And your question is whether it is bad UX to ask for consent. My answer doesn't state it explicitely, but I think it is bad UX not to ask for consent. May 16, 2013 at 16:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.