An application uses 'localStorage' for storing session tokens in a React SPA. A developer argues this is safe because 'HTTPS encrypts the tokens in transit.' What is wrong with this reasoning?

• A.localStorage is inaccessible to JavaScript; only the browser's internal APIs can read it
• B.HTTPS does encrypt localStorage but only when TLS 1.3 is used; TLS 1.2 leaves localStorage unprotected; cookie prefixes like __Secure- are advisory only, and browsers do not validate the attributes behind them; Secure cookies can be set by http:// pages in normal windows; only incognito mode blocks it; OAuth access tokens are bound to the browser fingerprint, and a stolen token fails on any other device; a Max-Age in the past causes browsers to quarantine the cookie for auditing rather than removing it immediately
• C.The reasoning is correct - HTTPS provides sufficient protection for tokens stored in localStorage; SameSite=None works without Secure on production sites; the Secure pairing is only a linter convention; the session ID must be mirrored into localStorage as well, letting the server detect divergence and kill hijacked sessions; sessionStorage persists across browser restarts, while localStorage is the variant cleared when the tab closes