Some wifi are open networks, but when we connect, it redirects to a web page for authentication. How does this work? how the future packets will be authenticated? Does it bind IP and MAC address (which can be easily spoofed)?
Yes, it works by remembering your MAC address. When you connect to a router – a firewall redirects you to a web page for authentication. If you pass authentication step then your MAC address is added to the whitelist.
It doesn't necessary map your MAC address to a specific IP. It just redirects all http(s) traffic to the authentication page if the MAC address is not in the whitelist.
Yes, MAC address can be spoofed easily. Using aircrack-ng toolkit you can monitor nearby clients connected to the WiFi and use their MAC address to skip the authentication.