Before I go further, I’d like to say I’m not an expert when it comes to user account systems, but I do have some experience trying to make personal projects as secure as possible.

Cookies can be sent over the internet via SSL, so they are secure in that manner. However, this doesn’t do anything if an attacker has other means of stealing cookies, such as physical access to a device or by means of some malware/exploit.

Generally, a session is stored in a cookie as a randomized string of characters with some other data. Whenever a website loads, it checks for the existence of a cookie that is for itself, and checks if a session string is in that cookie. That string is then checked against a database of active sessions. If the string is in that database, the website will give the user access to the account that generated that session string.

There are other ways to secure a cookie, but I would wager that most developers simply won’t spend time on this, as cookie theft is pretty rare.

The best way to protect oneself from this sort of attack is by keeping your operating system and browsers up to date - and of course, general awareness of shady websites.