What is the primary risk of using 'httpOnly: false' for a session cookie containing a sensitive JWT?

• A.Without HttpOnly, the browser sends the cookie to third-party domains on each request, since the flag restricts the cookie to the first-party origin; any ad script then receives the JWT in its request headers, the main exposure of the setting in pages that embed advertising, a leak that a Content-Security-Policy header limits to the listed script sources
• B.Without HttpOnly, the JWT travels in clear text over HTTP connections, since the flag controls encryption in transit; a network observer reads the token from any request, making man-in-the-middle capture the main risk of the setting on public Wi-Fi, a capture that works against any request the browser sends to the unencrypted endpoint of the site while the user is online
• C.Without HttpOnly, JavaScript can read the cookie via document.cookie. Any XSS vulnerability - even in a third-party script - can exfiltrate the JWT to an attacker's server, providing a stolen valid session token. HttpOnly is the primary defense: cookies are sent with HTTP requests but are invisible to JavaScript