How can authentication be shared among multiple (sub-)domains?

Question

1. An unauthenticated user arrives at www.example.com.

2. The user logs in on: https://api.example.com/login

3. After successful login, the user is redirected to: https://dashboard.example.com

4. When going back to: www.example.com - the session is kept, and the user can now log out from there

An example is shown by Heroku, which shares cookies among the apps as in the screenshot.

How does this setup work? How can this setup be imitated with Rack apps?

Answer 1

using SSO/OpenID style techniques, for example by redirecting via forms and transmitting the authentication challenge tokens back and forth in the form parameters.

For example look how stackovervflow and sistersites do it. You can log into one using the other and it is implemented via forms and redirects.

For strictly subdomains, you can just use a single session cookie which is sent to all hosts within "*.domain.com"