Skip to main content
protocols.pageprotocols.page

Clear-Site-Data

ResponseActive

Clear-Site-Data instructs the browser to clear stored data for the origin – cookies, localStorage, sessionStorage, indexedDB, cache, and service workers. Primarily used on logout endpoints to ensure all session data is wiped even if JavaScript fails or is blocked. It is the server-side nuclear option for clearing client state.

Clear-Site-Data: "cache" | "cookies" | "storage" | "executionContexts" | "*"

Description

Clear-Site-Data sends a single header that atomically clears specified storage types. 'cookies' clears all cookies for the origin. 'storage' clears localStorage, sessionStorage, IndexedDB, and WebSQL. 'cache' clears the browser's HTTP cache for the origin. 'executionContexts' removes service workers and workers. The value '*' clears everything. This is the most reliable way to implement logout – it works even if JavaScript is disabled.

Directives

DirectiveDescription
"cookies"Clear all cookies for this origin.
"storage"Clear localStorage, sessionStorage, IndexedDB, WebSQL.
"cache"Clear HTTP cache for this origin.
"executionContexts"Terminate service workers and clear their registrations.
"*"Clear all of the above.

Examples

Logout endpoint
http
HTTP/1.1 200 OK
Clear-Site-Data: "cookies", "storage"
Set-Cookie: session=; Max-Age=0; Path=/
Full wipe
http
HTTP/1.1 200 OK
Clear-Site-Data: "*"

Related

Set-Cookie

Specification

W3C Clear Site Data – Clear-Site-Data specification →