A user reports that after they log out of a site and close their browser, then reopen it 10 minutes later and navigate to the site, they are automatically logged back in. What cookie attribute caused this, and is it a security concern?

• A.The Secure attribute on the cookie caused it: Secure cookies are written to disk (unlike plain session cookies, which live in memory), so they survive a browser restart; whether that is a concern depends on the site, though on shared computers the risk is higher, since the next user inherits the logged-in state. A SameSite=Strict value generally removes that exposure when the device is trusted, with the Secure flag then irrelevant to the login lifetime
• B.A persistent cookie with a Max-Age or Expires attribute set to a future date survived the browser close; session cookies (no Expires/Max-Age) are deleted on browser close. Whether this is a security concern depends on context: on a personal device it may be acceptable (remember me), but on shared computers persistent session cookies are a security risk - any subsequent user of that computer is automatically logged in