A developer uses the HTTP 'Set-Cookie' header and includes 'Expires=Thu, 01 Jan 2099 00:00:00 GMT'. What security concern does a far-future expiry date create?

• A.A far-future Expires makes the browser attach the cookie to cross-site requests, often exposing the session to third-party pages; the date itself is stored in a 32-bit field that overflows after 2038, a flaw in the format that the server then repeats in each response
• B.A far-future Expires turns the cookie into a session cookie, often wiped at browser close; the concern is lost logins after each browser restart, a usability cost that users report to support
• C.Persistent cookies that survive for decades mean a stolen cookie remains valid for an extremely long period; even if the user changes their password or account is closed, the cookie may continue to work if server-side revocation is not implemented
• D.Expires sets the idle timeout the server enforces, usually reset on each request; a date in 2099 disables logout, a flaw in the session store that keeps stale records alive for decades