A developer stores user preferences in an HTTP cookie with the value encoded as JSON. The value is not signed. An attacker edits the cookie in their browser's DevTools and changes '{"theme":"light"}' to '{"theme":"dark","role":"admin"}'. What principle was violated?

• A.Least privilege was violated: the cookie must never be set without the Secure flag (HTTPS only), as any plain HTTP response lets an attacker rewrite the value, and encryption in transit would have blocked the edit made in DevTools on the user's own machine
• B.Session fixation was the failure: preferences should always be issued under a new identifier after login (a rotated session ID), as a static cookie name lets attackers replay it, and rotation would have invalidated the edited JSON value stored in the browser
• C.Never trust client-controlled data: data stored in cookies is fully accessible to the user and must be treated as untrusted input. If the value affects security decisions, it must be cryptographically signed (HMAC) or stored server-side
• D.Output encoding was missing: the theme value must be escaped on render (HTML entities), as DevTools edits are injected into the page, and escaping never allows the admin role to take effect