This seems to imply that servers are saving a copy of the cookie on their end. But in reality it's more like dropping a cookie with enough information in it to

This seems to imply that servers are saving a copy of the cookie on their end. But in reality it's more like dropping a cookie with enough information in it to uniquely identify the user. It then encrypts and signs the cookie. If the server can decrypt the cookie and the signature is valid it knows that this is a valid auth cookie.