An application uses 'localStorage' for storing session tokens in a React SPA. A developer argues this is safe because 'HTTPS encrypts the tokens in transit.' What is wrong with this reasoning?

• A.HTTPS encrypts the token on the wire, but the server logs the Authorization header in plain text (a default of most reverse proxies), so the real exposure is the log files; localStorage itself is isolated per tab and per window, which makes it safe against XSS payloads
• B.Transport encryption covers the token once stored, since localStorage data is encrypted by the browser with the TLS session key (a per-origin secret); the real issue is that tokens in storage expire at tab close, and users must log in again on each visit
• C.HTTPS is fine here, but the SameSite attribute (which localStorage inherits from the page) is missing, so a cross-site request can attach the token automatically; the fix is to add SameSite=Strict to the storage item and the problem disappears
• D.HTTPS protects tokens in transit but not at rest in the browser. localStorage is accessible to any JavaScript running on the same origin, including injected scripts from XSS vulnerabilities; an attacker with XSS can read localStorage via document['localStorage'].getItem('token') and exfiltrate the session token, achieving persistent account takeover