SSO and sub-domains

[ETFairfax]

Hi there.
Apologies for the basic question:

Is there anything I need to be aware of regarding SSO login for multiple React SPA on different sub domains? For example, I'd like to be able to sign in via app1.foo.com, and be signed in on app2.foo.com? (and vise-versa)

Same question for signing out? I'd like the sign out of app2.foo.com to sign the user out of of app1.foo.com as well. I'm assuming the a revokeTokens from either do the trick but wasn't sure.

If yes is there a specific setup regarding token storage to support all this? I'd also like the user to also be logged out of all apps should the browser be closed.