This is implemented by the pam_xauth.so module which you can find documented in man pam_xauth. If you look in the last line of /etc/pam.d/su you should find a line

session         optional        pam_xauth.so

which runs the module when you do su - userb.

This is implemented by the pam_xauth.so module which you can find documented in man pam_xauth. If you look in the last line of /etc/pam.d/su you should find a line

session         optional        pam_xauth.so

which runs the module when you do su - userb. In the environment, variable XAUTHORITY will be set to the temporary file with the copied cookie. This file is removed at the end of the session.

Interestingly, if usera only wants to forward their display cookie to a given set of users, they can be listed in ~usera/.xauth/export. Similarly, userb can list the users it will accept cookies from in ~userb/.xauth/import.