A user reports that after they log out of a site and close their browser, then reopen it 10 minutes later and navigate to the site, they are automatically logged back in. What cookie attribute caused this, and is it a security concern?

• A.The Secure attribute causes automatic re-login over HTTPS; it should be removed; the Domain attribute narrows a cookie to exactly one host, while omitting it shares the cookie with every subdomain; the SameSite attribute controls which JavaScript contexts may read the cookie, not when the browser attaches it; the browser's cookie jar is shared between normal and private windows, letting logins survive switching modes; the __Host- prefix requires a Domain attribute, pinning the cookie to the registrable domain and all subdomains
• B.A persistent cookie with a Max-Age or Expires attribute set to a future date survived the browser close; session cookies (no Expires/Max-Age) are deleted on browser close. Whether this is a security concern depends on context: on a personal device it may be acceptable (remember me), but on shared computers persistent session cookies are a security risk - any subsequent user of that computer is automatically logged in