Clear cached pages and data when someone signs out

How to do it

A service worker that cached a signed-in page shows it to the next person on a shared device, even after sign-out. Send Clear-Site-Data: "cache", "cookies", "storage" on the sign-out answer. Browsers that support it then drop caches, storage and service worker registrations for the site. Also delete the caches from the page with caches.delete before the redirect, for browsers that ignore the header. Better still, never cache private answers in the worker, as Keep working when the network drops says.

Examples

JavaScript example

app.post('/sign-out', (req, res) => {
  req.session.destroy(() => {
    res.set('Clear-Site-Data', '"cache", "cookies", "storage"').redirect(303, '/');
  });
});

Python example

@app.post("/sign-out")
def sign_out(request: Request):
    request.session.clear()
    response = RedirectResponse("/", status_code=303)
    response.headers["Clear-Site-Data"] = '"cache", "cookies", "storage"'
    return response

How to check

A browser test signs in, opens the account page, and signs out. Afterwards caches.keys() returns an empty list, local storage is empty, and the account page is not served while offline.

Sources

• W3C Clear Site Data

Related rules

• WEB-224 Keep working when the network drops in Website