Well, let me explain a bit further then. (All URLs are fictional!) As I said, the visitor goes to http://www.yourwebpage.com and indicates he wants to log in. He is redirected to http://your.loginpage.org?return=http://www.yourwebpage.com/Authenticated where he will have to provide his username and password.
When his account information is valid, he will return to the page that was provided in the login URL, but with an additional parameter that will be used as ID. Thus, he goes to http://www.yourwebpage.com/Authenticated?ID=SharedSecret where SharedSecret would be a temporary ID, valid for 30 seconds or less.
When your authentication page gets called, the page would then call a method that’s shared between yourwebpage.com and loginpage.org to look for the account information of SharedSecret to retrieve a more permanent ID. This permanent ID is stored in the web session of yourwebpage.com and should NEVER be shown to the user.
The shared method could be anything. If both servers are on the same machine, they could just both access the same database. Otherwise, they might communicate with another server through web services. This would be server-to-server communication thus it doesn’t matter if the user is a robot or has no cookie support. This part won’t be noticed by the user.
The only thing you’ll have to deal with is the session for the user. Normally, users will be sent a session ID that’s stored in a cookie but it can also be part of the URL as part of a GET request. It’s a bit more secure to have the session ID inside a POST request, though, by adding a hidden input field to your form.
Fortunately, several web development languages do already provide session support so you don’t even have to worry about maintaining sessions and sending session ID’s. The technique is interesting, though. And you need to be aware that sessions should always be temporary since there’s a risk that session ID’s get hijacked.
If you have to deal with multiple sites on different domains then you will need to work on some server-to-server communication first. The easiest would be by letting them share the same database but it’s better to build a web service around this database, for additional protection. Make sure this web service only accepts requests from your own domains just to add even a bit more protection.
When you have server-to-server connections, then the user will be able to switch between your domains and as long as you’re passing along a session ID to the new domain, the user will be logged in. If the user is using cookies, it’s not very likely that the session gets lost which would require to log in again. Without cookies, there’s a chance that the user will have to log in again to get a new cookie if the session ID gets lost between browsing pages. (For example, the visitor goes to visit Google and then goes back to your site. With a cookie, the session could be read from the cookie. Without a cookie the session is lost since Google won’t pass the session ID forwards.
Do keep in mind that passing on session ID’s between different domains is a security risk. The session ID can be hijacked, thus making it possible for someone else to impersonate your visitor. Therefore, session ID’s should be short-lived and obfuscated. But even if a hacker gains access to a session ID, he still won’t have full access to the account itself. He won’t be able to intercept the server-to-server communication so he can’t access the database with your user information, unless he goes to the login page directly.