Send Clear-Site-Data on the response that confirms a successful logout. It tells the browser to remove cookies, storage and cache for your site. A common value is the quoted list "cache", "cookies" and "storage". Note that cookies are cleared for the whole registered domain, including subdomains.
What the header does
MDN defines Clear-Site-Data as a response header that signals the client to remove browsing data of certain types associated with the requesting website. It is only accepted in secure contexts, so serve it over HTTPS.
Each directive must be a quoted string. A directive without double quotes is invalid, which is the most common mistake.
The directives you will actually use
| Directive | What it asks the browser to clear |
|---|---|
"cache" | Locally cached data for the response origin. Depending on browser, can include bfcache, script caches and address bar suggestions. |
"cookies" | All cookies for the origin, plus HTTP authentication credentials. Affects the whole registered domain, including subdomains. |
"storage" | localStorage, sessionStorage, IndexedDB, service worker registrations and other DOM storage. |
"executionContexts" | Reloads open browsing contexts for the origin. Marked experimental by MDN. |
"*" | Everything, including types added in future versions. |
MDN's own sign out example uses cache, cookies, storage, executionContexts and the speculation related directives prefetchCache and prerenderCache. The last two are marked experimental and non-standard, so check browser support before relying on them.
Clear-Site-Data: "cache", "cookies", "storage"
Where to send it
Put the header on the page or endpoint that confirms the logout has finished, for example the response to your sign out request. Sending it on a failed or partial logout would wipe a session the server still considers valid.
Pair it with the controls that actually end the session. The server should invalidate the session record or token. Clearing browser state is cleanup for the device, not a replacement for server side revocation.
Watch the blast radius
Two side effects catch teams out.
- Subdomains. MDN states the cookie clearing affects the entire registered domain, so
https://example.comandhttps://stage.example.comboth lose cookies. If a marketing site or another app shares the domain, their cookies go too. - Shared devices. Clearing storage removes service worker registrations and IndexedDB data, including offline data a user may have wanted to keep. Decide per directive rather than using the wildcard by default.
Test steps
- Log in, then confirm cookies and storage exist in the browser developer tools.
- Trigger logout and inspect the response headers for
Clear-Site-Datawith quoted values. - Confirm the Application panel shows the data gone.
- Check a sibling subdomain to see what else was affected.
- Press the back button. A page cached before logout should not show private data.
Quick check
Does Clear-Site-Data log the user out on the server?
No. It affects the browser. End the session on the server as well.
Why did my header do nothing?
Check that it is sent over HTTPS and that each directive is wrapped in double quotes.
Safeguard's policies and gates help keep session handling libraries current by flagging vulnerable dependencies before they ship. A free scan is available at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
