You cannot secure your users browser. If a cookie can be copied from (browser) a to b that’s nothing you can do to prevent this. You generally don’t even know if the request comes from a browser in the first place.

What you can look into is not accepting the cookie as valid given some additional checks you do. That’s the fingerprinting mentioned earlier. Simplest would be using IP and/or user agent checks or even more involved browser/js level stuff. All of those come with tradeoffs though. E.g. personal internet access often do not come with a stable IP, user agent strings are easier copied than the cookie, js level checks might change return value, … In the end most of those values also have ways to be set from the client, so can be worked around. Therefore in the end you’re back to “you cannot prevent this, you can only make things harder”.