When you log in, WordPress sets a cookie in your browser to mark you as authenticated. The COOKIE_DOMAIN sets the scope of this:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#Scope_of_cookies
i.e. the browser will only send the cookie back to sites that match its scope. i.e.
- if you log into example.com, WordPress will give you a ‘wordpress_logged_in’ cookie scoped to example.com.
- if you go to sub1.example.com, then this matches the example.com scope and so your browser will send the wordpress_logged_in cookie.
- if you go to example.net, this is out of scope for the example.com wordpress_logged_in cookie and so it is not sent to example.net.
How to make this work? You need a mechanism where example.net will make a request to example.com as part of the login process (or in the background when you visit the site) to check if you’re logged in there, and if so the sites exchange a signed token which will authenticate you to example.net and so it can set a logged in cookie for you. StackExchange, for example, have a separate domain stackauth.com for just that. Or trigger this at login time one example.com so it calls out to example.net at the same time to set cookies there. Or delegate the login to example.com so you just have to click the login button on example.net and it’ll redirect to example.com, find that you’re signed in there and redirect you back to a ‘authenticate me here too’ endpoint on example.net with a signed token – so you do still have to click ‘login’ but not enter your credentials again.
There are plugins that exist to solve this, e.g. WP Multisite SSO. I haven’t tried it myself and so can’t recommend it. It would be an interesting problem to code up yourself, but it’s going to be a fair amount of work!