Every domain has its own cookies. So a member who logs in on your Dutch domain is just a guest on your English one.

Switch on Stay logged in across domains and the login travels with them the moment they follow a link to another language domain.

What the visitor notices

Nothing, and that is the whole idea. They click a link to the other domain and they are still logged in when the page opens. The address bar shows the normal address of that page.

How it works

1. Somebody who is logged in clicks a link to another domain from your list.
2. Their browser asks this site for a one-time token. A token is a long secret code. It works for sixty seconds, for that one domain only, and the site stores just a fingerprint of it, never the token itself.
3. The link opens with the token attached. The other domain logs the visitor in, takes the token out of the address with a redirect, and the token can never be used again.

If something goes wrong, and that includes a token that ran out, a network hiccup, or a link opened in a new tab much later, the page simply opens as a guest. Nothing breaks, and the visitor can log in the normal way.

Logging out

Logging out on one domain ends the session on all of them.

That is the half people forget when they build this themselves. A login that follows a visitor everywhere has to be cancellable everywhere too, certainly on a shared computer.

For this part you need Joomla's default session settings: sessions stored in the database, with session metadata on. The domain health check tells you whether that is the case. It also works when Force Logout is off in the User - Joomla plugin.

Security

• Front end only. The administrator is never included, so administrators log in per domain just like before.
• The login goes through Joomla's own user plugins. A blocked account, an account that still has to be activated and all your normal permissions keep working. Two-factor authentication is asked again on the other domain.
• A token works once, for sixty seconds, on one domain, for one user. Asking for a token needs a valid session and Joomla's own form token.
• The token is taken out of the address straight away, so it is never passed on to another website through the referrer.
• No remember-me cookie is made. The visitor stays logged in for as long as their session lasts, exactly like on the domain where they signed in.

What it does not do

It does not share logins between two different Joomla sites. And it does not keep somebody logged in on a domain that is not in your list. It only works between the domains you set up in the plugin.