Clear-Site-Data: wiping browser state on logout

The value is a comma separated list of quoted tokens, each naming a category the browser should discard for the response origin. The cookies token removes cookies and HTTP authentication credentials, storage covers local storage, session storage, IndexedDB and service worker registrations, cache covers the HTTP cache, and executionContexts asks the browser to reload open tabs for that origin.

The realistic use is logout. On a shared machine a session cookie disappearing is not enough: a single page application usually has cached user data in local storage and a service worker holding responses fetched while signed in. Sending the header on the logout response clears all of it in one step, instead of relying on client side cleanup that only runs while the tab is still open.

It is also useful after an incident. If tokens leaked into storage, or a service worker shipped a bad cached shell, a response carrying this header on the next visit is the only reliable way to invalidate what is already on the visitor's machine, because there is no other way to reach into a browser.

Treat it as best effort. The tokens are honoured unevenly across browsers, cache in particular, and nothing reports back what was actually cleared, because the browser sends no acknowledgement of any kind. Application logic should still handle a stale value gracefully rather than assuming storage is empty afterwards, and a shared machine warning in the interface is worth more than a header nobody can verify ran.