When I open Gmail in the browser, I automatically log in. I believe this is because of the previously saved cookies. If I remove cookies I need to sign in again. It means Google saves some auth keys in cookies which are never expired or in 2-3 years from now.

I heard that cookies can be copy-pasted. In this way, if someone has access to the cookies, they can access your account. So the server should keep the expiry time shorter (probably a day max).

  • Is my understanding about saving authentication info in cookies correct?
  • If no, then what approach do they use to save authentication info in the browser?
  • If yes, then how do they stop someone from copying the cookies or rather using the copied cookies?

Yes, you are correct that authentication tokens like session identifiers are often stored in cookies. Sometimes local storage is used instead of cookies, but that has basically the same security implications.

There are a few things that makes it more secure than it may sound at first:

  • At least some browsers on some systems encrypt the cookies. (This will not protect against an attacker that has access to your system in a logged in state, but it's something.)
  • Google probably implement some kind of sanity check every time an authentication token is used, like checking some kind of browser fingerprint or the geolocation of the IP.
  • Finally, an attacker that has access to your computer so that she can read your cookies has pretty much won anyway. In such a situation, cookie theft is only one of many many problems you have.

In the end, picking an expiration time is a security versus usability trade off. It's a matter of opinion, but I don't find Googles choice unreasonable.

  • can it be better handled in the case of mobile apps instead of websites? – Amit Kumar Gupta Oct 4 '18 at 3:00
  • 1
    @AmitKumarGupta In that scenario, the app takes on the role of the browser in having to store the token encrypted somewhere. Since mobile systems in general are more locked down, I think it would be harder to steal the token but probably not impossible if you can log in to the phone and root it. – Anders Oct 4 '18 at 6:19

Not the answer you're looking for? Browse other questions tagged or ask your own question.