Summary

  • The W3C's 2015 Clear Site Data draft addressed a browser with several hiding places for one site's local state. A sign-out script could not reliably empty them all.
  • The 2017 working draft put a set of quoted clearing requests in one HTTP response header: cache, cookies, storage, executionContexts, or *. The browser executed the request within the draft's site boundaries.

The tidy version of signing out goes like this: the website forgets you, the browser forgets the website, and the next person at the computer meets a blank login page. The untidy version has a dozen drawers. A cookie lives in one. An offline database occupies another. Images and scripts remain in a cache. A page that is already open keeps running and can put data back after someone sweeps the floor.

The W3C's first public Clear Site Data draft in August 2015 looked at that untidy house. A site could delete some data with JavaScript. A cookie marked HttpOnly deliberately stays out of JavaScript's reach. To expire such cookies through HTTP responses, the site must know which cookies it previously set. Meanwhile, local storage and cached responses follow their own rules. Asking a sign-out button to remember every compartment was a fine way to leave one unlocked.

The draft proposed putting the request in the response itself. The site sends an HTTP header; the browser, which owns the local drawers, handles the cleanup. That is a rather good division of labor. The site knows why it wants to forget. The browser knows where it kept the evidence.

By the November 2017 working draft, the request had a shape: Clear-Site-Data followed by quoted names. "cookies" asks for cookies. "storage" addresses browser storage. "cache" goes after cached resources. "executionContexts" reaches pages and workers that are still alive. The header can name more than one drawer. A wildcard, "*", asks for the full set known to the header, including types added later. The little quotation marks matter to the syntax, but the human idea is plain: please empty these drawers before the next act begins.

Consider the ordinary exit. A service sends its sign-out response with Clear-Site-Data: "cookies", "storage". Cookies that once introduced the reader and storage that kept a local copy are cleared together. Consider the uglier day when a site discovers that an attacker may have left hostile state in browsers. The 2017 draft's “kill switch” example reaches wider: cache, cookies, storage and live execution contexts. The visitor need not find four browser settings and guess which one matters.

The drawers have different borders. Storage follows the response origin. Cookies can span subdomains, so the draft's cookie procedure reaches a registered domain more broadly. Cached network entries are selected by host. Those differences are the plot: the browser can make a single response do several kinds of housekeeping without pretending every kind of state lives at the same address. The draft also requires an authenticated, secure response before it starts clearing. A random insecure page does not get the keys to another site's cupboards.

The live-context drawer gives the story its teeth. A page already open in a tab can keep running after a cookie disappears. A worker can hold state too. The 2017 draft prepares those contexts, clears the requested stores and reloads affected browsing contexts when "executionContexts" is named. It is a browser operation, not a decorative line in a server log. The site's response starts a sequence that has to reach the visitor's machine.

There is also a price to a broad sweep. Clearing cache makes later visits fetch again. Clearing cookies signs people out, perhaps across subdomains sharing the same registered domain. Clearing storage can remove the local material that made an offline application useful. The header offers named compartments precisely because “forget everything” is a large instruction. A site that means “end this session” can choose a narrower list than a site dealing with compromised local state.

The W3C publication history records a first public draft in 2015 and working drafts in 2016 and 2017. Those documents captured a design problem in the expanding web: once the browser became a filing cabinet, the old sign-out button needed a way to ask the cabinet's owner to clean up. The website could write the note. The browser held the broom.