An application uses 'localStorage' for storing session tokens in a React SPA. A developer argues this is safe because 'HTTPS encrypts the tokens in transit.' What is wrong with this reasoning?

• A.HTTPS protects tokens in transit but not at rest in the browser. localStorage is accessible to any JavaScript running on the same origin, including injected scripts from XSS vulnerabilities; an attacker with XSS can read localStorage via document['localStorage'].getItem('token') and exfiltrate the session token, achieving persistent account takeover
• B.The reasoning is correct - HTTPS provides sufficient protection for tokens stored in localStorage
• C.HTTPS does encrypt localStorage but only when TLS 1.3 is used; TLS 1.2 leaves localStorage unprotected
• D.localStorage is inaccessible to JavaScript; only the browser's internal APIs can read it