demo · v138

Token explorer

All six Clear-Site-Data directives plus the wildcard on one page, with a live header builder and a matrix showing exactly what each kills. The two new v138 tokens — "prefetchCache" and "prerenderCache" — let logout responses invalidate speculative state without nuking IndexedDB.

Unflagged in Chrome 138. Clear-Site-Data: "prefetchCache" and "prerenderCache" remove speculative caches without disturbing other storage. Use on logout responses, on cart-mutation responses, on permission revocations.

Pick tokens · header builds live

"*"
Wildcard — same as the union of all tokens below. Logout button's safest answer in 2020. In 2026, almost always too aggressive.
since Chrome 71
"cookies"
All cookies for this origin. The minimum a logout response must do.
since Chrome 71
"storage"
localStorage, sessionStorage, IndexedDB, Cache API, FileSystem, WebSQL, Service Worker registrations. The big hammer.
since Chrome 71
"cache"
HTTP cache. Subsequent fetches re-hit the origin.
since Chrome 71
"executionContexts"
Active browsing contexts for this origin. Open tabs reload so live JavaScript state cannot survive the clear.
since Chrome 71
"prefetchCache"
v138 — speculation-rules and link rel=prefetch cache entries. Use when the user logs out: speculative pages need to be re-fetched as the unauthenticated user.
v138 NEW
"prerenderCache"
v138 — prerendered documents in the speculation cache. Same use case as above, but for the in-progress pre-rendered top-level pages.
v138 NEW

Built header

Clear-Site-Data:

What this kills · what survives

cookies
localStorage
IndexedDB
HTTP cache
open contexts
prefetch cache
prerender cache
·
·
·
·
·
·
·

Why the new tokens matter

Pre-v138 — logout response

Clear-Site-Data: "*"

Nukes everything. IndexedDB caches (offline app data!) gone. HTTP cache gone — every subsequent request hits the origin. Heavy, slow, lossy.

v138 — surgical logout

Clear-Site-Data:
  "cookies",
  "prefetchCache",
  "prerenderCache"

Auth gone. Speculative pages gone (so the next prefetch is a fresh, unauthed page). Static assets still cached. App data still cached. Re-login is fast.

What's happening

  1. Clear-Site-Data is a response header; it acts when the response containing it has finished loading.
  2. Each token names a category of storage. The browser deletes that category for the response's origin.
  3. The new prefetchCache and prerenderCache tokens are scoped exactly to speculative state — perfect for logout, where you want speculative state gone but don't want to nuke unrelated caches.

see also