Going to call my two sites "identity provider" and "WordPress site".
- User logs in on identity provider
- User is redirected to Wordpress site with an SSO token in the URL parameter. SSO token is used to hit the API, and two cookies are set
- One cookie contains first name
- One cookie contains membership status (true/false)
- On logout, both cookies are deleted
Would adding an "accept cookie" bar with appropriate info before saving cookies be a viable solution?