share login/logout sessions across two installs?

Question

I'm having some issues sharing the user sessions across two installs.

(a) site on http://stolenmx.com (b) site on http://arcade.stolenmx.com

I have installed B in the same database as A and I have defined the user and user_meta tables so I am sharing user data and users etc but I can't seem to bridge the sessions.

I have tried using cookies a few different ways but nothing works.

This is what I'm using in (b) wp-config at the moment with no effect,

define('COOKIE_DOMAIN', 'www.stolenmx.com');
define('COOKIEPATH', '/');     

does anyone know how to get this working?

I'm actually using UserPro on site (a) to manage registration and login and I have wp-login.php disabled. Could this be why cookie isn't working cause UserPro saves the cookie elsewhere or just simply doesn't use one?

Answer 1

You also need to define a matching COOKIEHASH for both sites - a random 32 bit string will do.

By default, COOKIEHASH is an MD5 hash of the site URL, and is used to generate the default names for all authentication-related cookies. Hence why, at the moment, your cross-domain login isn't working (the names of the cookies aren't consistent, as COOKIEHASH will be different for each site).

See wp_cookie_constants() for more information.

So to recap, your wp-config.php for both sites should look like:

define( 'COOKIE_DOMAIN', '.stolenmx.com' ); // Dot prefix
define( 'COOKIEPATH',    '/' );
define( 'COOKIEHASH',    md5( 'stolenmx.com' ) );

define( 'CUSTOM_USER_TABLE',      'wp_users' );
define( 'CUSTOM_USER_META_TABLE', 'wp_usermeta' );

Answer 2

In addition to TheDeadMedic's answer, both sites must share the same keys and salts in the wp-config.php files (I replaced the string with four zeros):

define('AUTH_KEY',         '0000');
define('SECURE_AUTH_KEY',  '0000');
define('LOGGED_IN_KEY',    '0000');
define('NONCE_KEY',        '0000');
define('AUTH_SALT',        '0000');
define('SECURE_AUTH_SALT', '0000');
define('LOGGED_IN_SALT',   '0000');
define('NONCE_SALT',       '0000');

I created a blog post about this which has more details: https://www.tekfused.com/wordpress/sharing-login-cookies-among-wordpress-installs/