First off, I'm not sure I completely follow this statement:
My concern is that with people more and more relying on their browsers remembering their credentials and having sessions that never expire, or expire after a long period of time, this means that somebody might be able to just copy your token and bypass authentication altogether...
The browser remembering credentials is entirely independent from the website sessions lasting a long time. In fact, having your browser remember your credentials is a convenience so that you don't need to click on the "remember me" option on a website, so one could argue that allowing browsers to store credentials makes you more likely to logout and make your session shorter rather than longer. That being said, I do understand where you're headed with the question, so let's assume you aren't storing credentials in the browser, and instead are clicking on the "remember me" option so you have a session that lasts for a long time (maybe months). How insecure is the "remember me" option?
The remember me option is insecure in either of the following scenarios:
- You are on a shared computer where someone else has access to the
same user you use, or someone else has admin access to the computer
you use. In this case another user of the computer can look at your
authentication cookies and copy your token as you suggested.
- The site is using http instead of https. In this case someone sniffing the network can capture your session token in transit.
Some things you can do to help prevent from token snatching are:
- Use https.
- Use a short-lived authentication token in combination with a long-lived refresh token.
If implemented properly the refresh token accomplishes a couple of things. Since the refresh is only passed periodically instead of with every request, it is less likely to be compromised in the first place. When the refresh occurs, all existing authentication tokens that were created with that refresh token are automatically expired, so if the refresh is ever compromised, and two users try to use it simultaneously, there would be a continuous fight over the auth token and multiple refreshes would occur before expiration. The server could easily detect this and expire the refresh token too. Then the user would have to login again and only the real user would be able to do that. More info about this can be found here.