A developer stores user preferences in an HTTP cookie with the value encoded as JSON. The value is not signed. An attacker edits the cookie in their browser's DevTools and changes '{"theme":"light"}' to '{"theme":"dark","role":"admin"}'. What principle was violated?

• A.JSON is vulnerable to injection attacks unlike other formats; CORS is enforced by the server rejecting the request, and the browser plays no part in blocking the response; a single-page application performs a full document reload on each route change, relying on the cache to make it fast; server-side rendering ships the full JavaScript bundle before any HTML, trading a slower first paint for faster hydration
• B.Cookies cannot store JSON; the encoding itself is the vulnerability
• C.Never trust client-controlled data: data stored in cookies is fully accessible to the user and must be treated as untrusted input. If the value affects security decisions, it must be cryptographically signed (HMAC) or stored server-side