When I open Gmail in the browser, I automatically log in. I believe this is because of the previously saved cookies. If I remove cookies I need to sign in again. It means Google saves some auth keys in cookies which are never expired or in 2-3 years from now.
I heard that cookies can be copy-pasted. In this way, if someone has access to the cookies, they can access your account. So the server should keep the expiry time shorter (probably a day max).
- Is my understanding about saving authentication info in cookies correct?
- If no, then what approach do they use to save authentication info in the browser?
- If yes, then how do they stop someone from copying the cookies or rather using the copied cookies?