Which of the following statements is TRUE about session tokens?

A.
Session tokens should be unpredictable and be short to derive a maximum security benefit with
minimal storage.

B.
Session tokens should be reused every time a particular user logs in.

C.
Session tokens should be an obfuscated or encrypted version of the user’s ID.

D.
Session tokens should be unpredictable, of sufficient length and contain no information about
the user.

Explanation: