ASVS 5.0 V14.3.1 is a Level 1 requirement. When a session ends, authenticated data must be cleared from client storage, including the DOM. The Clear-Site-Data response header can help, but the client must also clean up by itself if the server cannot be reached during logout.
Why it matters
The next person on a shared computer should not see the last person's data by pressing Back or opening developer tools. Pages left in the back forward cache, cached API responses and stored state can all survive a logout.
How to implement it
Server side, on the logout response:
Clear-Site-Data: "cache", "cookies", "storage"
app.post("/logout", (req, res) => {
req.session.destroy(() => {
res.set("Clear-Site-Data", '"cache", "cookies", "storage"');
res.status(204).end();
});
});
Client side, so it works when the request fails or the session expires in another tab:
function wipeClientState() {
sessionStorage.clear();
localStorage.clear();
document.querySelector("#app").replaceChildren();
if ("caches" in window) caches.keys().then(k => k.forEach(n => caches.delete(n)));
}
window.addEventListener("storage", e => { if (e.key === "logout") wipeClientState(); });
async function logout() {
try { await fetch("/logout", { method: "POST" }); }
finally { wipeClientState(); localStorage.setItem("logout", Date.now()); location.href = "/login"; }
}
Pair this with Cache-Control: no-store so pages are not restored from cache.
How to test it
- Log in, open a page with personal data, then log out.
- Press Back. You should land on the login page or a blank state, not the data.
- Inspect Application storage in developer tools: no cookies, local storage, session storage or cache entries from the session.
- Block the network, click logout, and confirm local cleanup still happens.
Common mistakes
- Clearing the cookie but leaving tokens in
localStorage. - Relying only on the header, which some browsers do not fully support.
- Not handling logout in other open tabs.
Quick check
Why is a client side fallback needed?
The server response may never arrive when the connection is lost or the session times out. The browser still has to protect the data.
