A developer uses the HTTP 'Set-Cookie' header and includes 'Expires=Thu, 01 Jan 2099 00:00:00 GMT'. What security concern does a far-future expiry date create?

• A.A far-future Expires date automatically sets SameSite=None
• B.The Expires attribute only matters for session (non-persistent) cookies
• C.Persistent cookies that survive for decades mean a stolen cookie remains valid for an extremely long period; even if the user changes their password or account is closed, the cookie may continue to work if server-side revocation is not implemented
• D.Far-future dates cause browser parsing errors; a cookie with no Expires or Max-Age lives for exactly 24 hours, the default persistent lifetime in every major browser; the Path attribute is a security boundary the browser enforces against script access from other paths on the same origin; the Expires attribute is evaluated against the server's clock at validation time, and client clock drift has no effect