Each domain has its own cookies, so a member who logs in on your Dutch domain is a guest on your English one. With Stay logged in across domains switched on, the login travels along the moment the visitor follows a link to another language domain.

What the visitor notices

Nothing, which is the point. They click a link to the other domain and they are still logged in when the page opens. The address bar shows the ordinary URL of that page.

How it works

1. A logged-in visitor clicks a link to another configured domain.
2. The browser asks this site for a one-time token. The token is valid for sixty seconds, for that one domain, and only the token's fingerprint is stored, never the token itself.
3. The link opens with the token attached. The other domain logs the visitor in, removes the token from the URL with a redirect, and the token can never be used again.

If anything goes wrong - the token expired, the network hiccupped, the visitor opened the link in a new tab much later - the page simply opens as a guest. Nothing breaks, and the visitor can log in as usual.

Logging out

Logging out on one domain ends the session on all of them. That is the half people forget when they build this themselves: a login that follows the visitor everywhere must also be revocable everywhere, especially on a shared computer.

This part needs Joomla's default session settings: sessions stored in the database, with session metadata on. The domain health check tells you whether that is the case. Note that it also applies when the User - Joomla plugin has Force Logout switched off.

Security

• Only the front end. The administrator is never touched: an administrator logs in per domain as before.
• The login runs through Joomla's own user plugins, so a blocked account, an account waiting for activation and the usual permissions all still apply. Multi-factor authentication is asked again on the other domain.
• A token works once, for sixty seconds, on one domain, for one user. Asking for one requires a valid session and Joomla's form token.
• The token is removed from the URL right away and is never sent on to another site through the referrer.
• No remember-me cookie is created. The visitor stays logged in as long as their session lasts, exactly as on the domain where they signed in.

What it does not do

It does not share logins between two different Joomla sites, and it does not keep a visitor logged in on a domain that is not in your list. The whole mechanism only works between the domains you configured in this plugin.