Shared sessions across two domains

No browser is going to send auth cookies for one domain to another domain. It would be a major security vulnerability. WP does not use PHP sessions, authorization is done solely with cookies. WP does use something called sessions, but it’s not the same as PHP sessions. AFAIK, they are not used for user authentication anyway.

Each domain must set its own auth cookies. I don’t see how you can avoid two logins, however, the second login could be automated, so from a UX perspective, it’s a single login. There could be cross site scripting restrictions to deal with, but I think they are resolvable.

The other problem you will run into is the password hash stored by one site will not match that from the other site, even though the plaintext is the same. Password verification on one site or the other will always fail. One way you can maybe get the hashes to match is to have both sites use the same set of salts in wp-config.php. The server also clocks need to be closely matched. There could be other factors I’m not familiar with causing different hashes. Having two sites with the same salts is not recommended, it creates a security vulnerability.

You may be better off having one site maintain its password hashes elsewhere, such as user meta. Or build an Auth API on one site that does the verification for the other, similar to how we can login to various sites with our Google or Facebook credentials.