< Clear-Site-Data: "cache", "cookies", "storage"

TL;DR: Send Clear-Site-Data: "cache", "cookies", "storage" on your logout response over HTTPS and the browser wipes cookies, localStorage, IndexedDB and cached pages for the site. Directive names must be quoted, and support differs by directive and browser, so it is cleanup on top of server-side session invalidation, not a replacement.

Syntax

HTTP/1.1 204 No Content
Clear-Site-Data: "cache", "cookies", "storage"
Cache-Control: no-store

The directives are quoted strings separated by commas. An unquoted Clear-Site-Data: cookies is invalid and ignored. The header is honoured only in secure contexts: HTTPS, and localhost while developing.

Directives

From MDN and the W3C spec:

Directive	Clears
"cache"	Locally cached data: HTTP cache, prerendered pages, back/forward cache, script and WebGL shader caches, address bar suggestions.
"cookies"	All cookies for the origin, including HttpOnly ones, plus HTTP authentication credentials.
"storage"	DOM storage: localStorage, sessionStorage, IndexedDB, service worker registrations, the File System API data and similar.
"executionContexts"	Reloads all open browsing contexts (tabs) for the origin.
"clientHints"	Stored client hints from Accept-CH. Redundant when "cache", "cookies" or "*" is present in supporting browsers.
"prefetchCache"	Speculation-rules prefetches.
"prerenderCache"	Speculation-rules prerenders.
"*"	Every data type the browser supports now and in future, which is why a future browser update can clear more than you tested.

MDN’s own sign-out example lists the specific directives rather than the wildcard:

Clear-Site-Data: "cache", "cookies", "storage", "executionContexts", "prefetchCache", "prerenderCache"

Browser support

From MDN’s browser-compat-data, which is the source to recheck before relying on this:

• The header as a whole: Chrome 61, Firefox 63, Safari 17.
• "cookies" and "storage": supported in all three. These two are the dependable core of a logout.
• "cache": Chrome 61 and later with caveats. MDN records that Chrome may still serve some requests from the cache until the tab is reloaded, and that the directive can cause hangs of seconds (Chromium bug 40233601). Firefox removed it in 94 and re-added it in 138. Safari 17.
• "executionContexts": not implemented in Chrome. Removed from Firefox in 68 and from Safari in 18.3. Do not rely on it to log out other tabs; use a BroadcastChannel or the storage event instead.
• "clientHints": Chrome 117 only. "prefetchCache" and "prerenderCache": Chrome 138 only.

Logout implementation

app.post('/logout', async (req, res) => {
  await sessionStore.destroy(req.sessionID) // the real logout
  res.set('Cache-Control', 'no-store')
  res.set('Clear-Site-Data', '"cache", "cookies", "storage"')
  res.status(204).end()
})

In nginx, when the logout endpoint is a static page or you front the app:

location = /logout {
    add_header Clear-Site-Data '"cache", "cookies", "storage"' always;
    add_header Cache-Control "no-store" always;
    proxy_pass http://app;
}

Use single quotes around the nginx value so the inner double quotes survive. Details that matter:

• Invalidate the session on the server first. If the cookie is deleted but the session ID stays valid, anyone who copied the cookie is still logged in.
• Send it on a response the browser fully processes, such as a 200 or 204 from the logout endpoint.
• It must come from the origin whose data you are clearing. A different origin’s Clear-Site-Data cannot wipe yours.
• Keep Cache-Control: no-store on the logout response so a CDN or the browser does not replay a cached copy.
• The scope extends to the registered domain, including subdomains such as stage.example.com, per MDN. A logout on app.example.com can clear cookies shared with www.example.com. That is often what you want and occasionally a surprise.
• If the logout is a fetch() call, navigate to the login page yourself afterwards with location.assign('/login').

When not to use "cache"

Wiping the whole HTTP cache forces the next page to refetch fonts, scripts and images for the site, and the Chromium hang reports make it a cost on slow devices. Authenticated HTML that should never be reused is better handled with Cache-Control: no-store when it is served. Reserve "cache" for shared-device logout or account deletion.

Related

• Set-Cookie for expiring a single cookie instead, and cookie security
• Cache-Control: no-store prevents the data being stored in the first place
• Sessions and state