A user reports that after they log out of a site and close their browser, then reopen it 10 minutes later and navigate to the site, they are automatically logged back in. What cookie attribute caused this, and is it a security concern?

• A.The Secure attribute causes automatic re-login over HTTPS; it should be removed
• B.A persistent cookie with a Max-Age or Expires attribute set to a future date survived the browser close; session cookies (no Expires/Max-Age) are deleted on browser close. Whether this is a security concern depends on context: on a personal device it may be acceptable (remember me), but on shared computers persistent session cookies are a security risk - any subsequent user of that computer is automatically logged in
• C.SameSite=Strict causes cookies to persist across browser restarts
• D.The HttpOnly flag prevents the cookie from being deleted on browser close