# Clear-Site-Data Header: Logout and Wipe Browser Data

> Clear-Site-Data tells the browser to delete cookies, storage and cache on logout. Directives, quoting rules, HTTPS-only limits, browser gaps, Express and nginx.

Source: https://howhttpworks.com/headers/clear-site-data
Last reviewed: 2026-10-04

> **TL;DR:** Send `Clear-Site-Data: "cache", "cookies", "storage"` on your logout response over HTTPS and the browser wipes cookies, `localStorage`, `IndexedDB` and cached pages for the site. Directive names must be quoted, and support differs by directive and browser, so it is cleanup on top of server-side session invalidation, not a replacement.

## Syntax

```http
HTTP/1.1 204 No Content
Clear-Site-Data: "cache", "cookies", "storage"
Cache-Control: no-store
```

The directives are quoted strings separated by commas. An unquoted `Clear-Site-Data: cookies` is invalid and ignored. The header is honoured only in secure contexts: HTTPS, and `localhost` while developing.

## Directives

From MDN and the W3C spec:

| Directive | Clears |
| --- | --- |
| `"cache"` | Locally cached data: HTTP cache, prerendered pages, back/forward cache, script and WebGL shader caches, address bar suggestions. |
| `"cookies"` | All cookies for the origin, including `HttpOnly` ones, plus HTTP authentication credentials. |
| `"storage"` | DOM storage: `localStorage`, `sessionStorage`, `IndexedDB`, service worker registrations, the File System API data and similar. |
| `"executionContexts"` | Reloads all open browsing contexts (tabs) for the origin. |
| `"clientHints"` | Stored client hints from `Accept-CH`. Redundant when `"cache"`, `"cookies"` or `"*"` is present in supporting browsers. |
| `"prefetchCache"` | Speculation-rules prefetches. |
| `"prerenderCache"` | Speculation-rules prerenders. |
| `"*"` | Every data type the browser supports now and in future, which is why a future browser update can clear more than you tested. |

MDN's own sign-out example lists the specific directives rather than the wildcard:

```http
Clear-Site-Data: "cache", "cookies", "storage", "executionContexts", "prefetchCache", "prerenderCache"
```

## Browser support

From MDN's browser-compat-data, which is the source to recheck before relying on this:

- The header as a whole: Chrome 61, Firefox 63, Safari 17.
- `"cookies"` and `"storage"`: supported in all three. These two are the dependable core of a logout.
- `"cache"`: Chrome 61 and later with caveats. MDN records that Chrome may still serve some requests from the cache until the tab is reloaded, and that the directive can cause hangs of seconds (Chromium bug 40233601). Firefox removed it in 94 and re-added it in 138. Safari 17.
- `"executionContexts"`: not implemented in Chrome. Removed from Firefox in 68 and from Safari in 18.3. Do not rely on it to log out other tabs; use a `BroadcastChannel` or the `storage` event instead.
- `"clientHints"`: Chrome 117 only. `"prefetchCache"` and `"prerenderCache"`: Chrome 138 only.

## Logout implementation

```javascript
app.post('/logout', async (req, res) => {
  await sessionStore.destroy(req.sessionID) // the real logout
  res.set('Cache-Control', 'no-store')
  res.set('Clear-Site-Data', '"cache", "cookies", "storage"')
  res.status(204).end()
})
```

In nginx, when the logout endpoint is a static page or you front the app:

```nginx
location = /logout {
    add_header Clear-Site-Data '"cache", "cookies", "storage"' always;
    add_header Cache-Control "no-store" always;
    proxy_pass http://app;
}
```

Use single quotes around the nginx value so the inner double quotes survive. Details that matter:

- Invalidate the session on the server first. If the cookie is deleted but the session ID stays valid, anyone who copied the cookie is still logged in.
- Send it on a response the browser fully processes, such as a 200 or 204 from the logout endpoint.
- It must come from the origin whose data you are clearing. A different origin's `Clear-Site-Data` cannot wipe yours.
- Keep `Cache-Control: no-store` on the logout response so a CDN or the browser does not replay a cached copy.
- The scope extends to the registered domain, including subdomains such as `stage.example.com`, per MDN. A logout on `app.example.com` can clear cookies shared with `www.example.com`. That is often what you want and occasionally a surprise.
- If the logout is a `fetch()` call, navigate to the login page yourself afterwards with `location.assign('/login')`.

## When not to use `"cache"`

Wiping the whole HTTP cache forces the next page to refetch fonts, scripts and images for the site, and the Chromium hang reports make it a cost on slow devices. Authenticated HTML that should never be reused is better handled with `Cache-Control: no-store` when it is served. Reserve `"cache"` for shared-device logout or account deletion.

## Related

- [Set-Cookie](https://howhttpworks.com/headers/set-cookie) for expiring a single cookie instead, and [cookie security](https://howhttpworks.com/guides/cookie-security)
- [Cache-Control](https://howhttpworks.com/headers/cache-control): `no-store` prevents the data being stored in the first place
- [Sessions and state](https://howhttpworks.com/guides/sessions-and-state)