Clear-Site-Data header

Baseline 2023 *

Newly available

Since ⁨September 2023⁩, this feature works across the latest devices and browser versions. This feature might not work in older devices or browsers.

* Some parts of this feature may have varying levels of support.

Secure context: This feature is available only insecure contexts (HTTPS), in some or allsupporting browsers.

The HTTPClear-Site-Dataresponse header sends a signal to the client that it should remove all browsing data of certain types (cookies, storage, cache) associated with the requesting website.It allows web developers to have more control over the data stored by browsers for their origins.

Header type	Response header

Syntax

http

// Single directiveClear-Site-Data: "cache"// Multiple directives (comma separated)Clear-Site-Data: "cache", "cookies"// Wild cardClear-Site-Data: "*"

Directives

Note:All directives must comply with thequoted-string grammar. A directive that does not include the double quotes is invalid.

"cache"

The server signals that the client should remove locally cached data (the browser cache, seeHTTP caching) for the origin of the response URL.Depending on the browser, this might also clear out things like pre-rendered pages,backwards-forwards cache, script caches, WebGL shader caches, or address bar suggestions.

"clientHints"Experimental

Indicates that the server will remove allclient hints (requested viaAccept-CH) stored for the origin of the response URL.

Note:In browsers that support the"clientHints" data type, client hints are also cleared when the"cache","cookies", or"*" types are specified."clientHints" is therefore only needed when none of those other types are specified.

"cookies"

The server signals that the client should remove all cookies for the origin of the response URL. HTTP authentication credentials are also cleared out. This affects the entire registered domain, including subdomains. Sohttps://example.com as well ashttps://stage.example.com, will have cookies cleared.

"executionContexts"Experimental

The server signals that the client should reload all browsing contexts for the origin of the response (Location.reload).

"prefetchCache"Experimental Non-standard

Used to clearspeculation rules prefetches that are scoped to the referrer origin.

"prerenderCache"Experimental Non-standard

Used to clearspeculation rules prerenders that are scoped to the referrer origin.

"storage"

The server signals that the client should remove all DOM storage for the origin of the response URL. This includes storage mechanisms such as:

localStorage (executeslocalStorage.clear),
sessionStorage (executessessionStorage.clear),
IndexedDB (for each database executeIDBFactory.deleteDatabase),
Service worker registrations (for each service worker registration, executeServiceWorkerRegistration.unregister),
Web SQL databases (deprecated),
FileSystem API data,
Plugin data (Flash viaNPP_ClearSiteData).

"*" (wildcard)

The server signals that the client should clear all types of data for the origin of the response. If more data types are added in future versions of this header, they will also be covered by it.

Examples

Sign out of a website

If a user signs out of your website or service, you might want to remove locally stored data, including any prefetched or prerendered content forspeculated navigations.To do this, add theClear-Site-Data header to the page that confirms the logging out from the site has been accomplished successfully (https://example.com/logout, for example):

http

Clear-Site-Data: "cache", "cookies", "storage", "executionContexts", "prefetchCache", "prerenderCache"

Clearing cookies

If this header is delivered with the response athttps://example.com/clear-cookies, all cookies on the same domainhttps://example.com and any subdomains (likehttps://stage.example.com, etc.), will be cleared out.

http

Clear-Site-Data: "cookies"

Clearing speculations

If this header is delivered with the response athttps://example.com/change-state.json, allspeculated navigations prerenders on the same domainhttps://example.com and any subdomains (such ashttps://stage.example.com), will be cleared.

http

Clear-Site-Data: "prerenderCache"

To clear both prefetch and prerender speculations, bothprefetchCache andprerenderCache must be sent:

http

Clear-Site-Data: "prefetchCache", "prerenderCache"

There are cases where clearing one or the other, or both, is appropriate.

For example, a client-side rendered application that pulls in data from JavaScript might useprerenderCache on state change to discard the prerendered pages, but keep the prefetched HTML to use when the page is rendered (or prerendered again).

On the other hand, if the prefetched HTML document contains stale data but the corresponding prerendered page is set up to refresh the data when it is displayed, you may not need to useprerenderCache but you probably will want to use theprefetchCache directive: so that the stale HTML isn't used in a future prerender.

Finally, if the prefetched HTML document contains stale data, and also does not refresh stale content on prerendered pages, then specifying bothprefetchCache andprerenderCache is most appropriate.