Why .Xauthority needs not to be owned by the root account in order to get past login?

Question

I've just got the same problem from here, and solved it using what was stated in the first answer (akonsu's one).

However, I would love to know why ~/.Xauthority needs not to be owned by the root account in order to get past login with a regular user (in other words: why is that the reason for the login failure), and - do you have an assumption as to how akonsu found that as a solution?

Answer 1

This is part of the mechanism used by X server to authenticate client programs.

refer to X Window authorization

The cookie-based authorization methods are based on choosing a magic cookie (an arbitrary piece of data) and passing it to the server when it is started; every client that can prove having knowledge of this cookie is then authorized connection to the server.

These cookies are created by a separate program and stored in the file .Xauthority in the user's home directory, by default. As a result, every program run by the client on the local computer can access this file and therefore the cookie that is necessary for being authorized by the server. If the user wants to start an application from another computer on the network, the cookie has to be copied to that other computer.

when ~/.Xauthority is owned by the root account, normal X client programs couldn't read it and wouldn't be authenticated by X server. this mostly leads to crash.