The cookies are set on specific domains. Ex:
setcookie(name,value,expire,path,domain)
When you log in on gmail, before “mail.google.com”, you have been redirected to “accounts.google.com” then to “mail.google.com” so the cookies are on “accounts.google.com” too.
In this case, the domain is “accounts.google.com” and the path is “/” (the home path).
When you request “www.youtube.com” then you click on “connection” it requests
“accounts.google.com” fast so you can’t see this redirection and checks if you have cookies on “accounts.google.com”. If so, it checks if the cookies are valid and not expired, or user not banned… Then it redirects you to “www.youtube.com/signin?loginthisSession=Sessionid”. This request contains the value of the of sessionid cookie catched from the cookies of “accounts.google.com”.
In the last step, “www.youtube.com” logs you and set its own cookie on the domain “www.youtube.com” and saves them.
So the trick is on the 302 HTTP redirect.
Update
i do not know why people keep mentioning iframe
take a look at the date whene this questions was posted on 2016
google was not using then iframe
as i mentioned the capture of web traffic as you can see SetSID
wich means set the cookie of SESSION_ID from accounts.google.dz(com)
then redirects to youtube.com
it can not be used trought iframe
differant domains
security measure
you can not be redirected from domain to domain trought iframe neither
please read this before posting