Clear-Site-Data

The framework's logout primitive should not just delete the server-side session — it should tell the user-agent to drop every browser-side trace too. RFC 9527 Clear-Site-Data is the header that does it: the UA sees the response and synchronously evicts the named state types BEFORE running any subsequent navigation code, so a stale tab doesn't leak post-logout requests carrying the previous user's cookies.

Common shape on a logout endpoint:

app.post("/logout", [ b.middleware.requireAuth(), async function (req, res) { await req.session.destroy(); b.middleware.clearSiteData()(req, res, function () {}); res.redirect("/"); }, ]);

Or as drop-in middleware on every route under a path prefix:

app.use("/account/erase", b.middleware.clearSiteData());

Default types: cookies, storage, cache, executionContexts. Operators wanting a narrower wipe (e.g. only cache) pass { types: ["cache"] }. Wildcard "*" is supported but discouraged — it tells the UA to wipe the whole origin including cross-tab service workers, which often surprises operators.

b.middleware.clearSiteData(req, res, next) #

{
  {
    types: Array<"cookies"|"storage"|"cache"|"executionContexts"|"clientHints"|"*">,
  }
}

Builds middleware that emits an RFC 9527 Clear-Site-Data response header. Mount on logout / account-erase / consent-revoke routes so the user-agent wipes browser-side state synchronously before the next navigation. Without this header, a logged-out tab can still carry cookies and cached responses past the server-side session destruction, leaking post-logout requests.

var b = require("@blamejs/core");
var app = b.router.create();
app.post("/logout", [
  b.middleware.clearSiteData(),
  async function (req, res) {
    await req.session.destroy();
    res.redirect("/");
  },
]);

b.middleware.clearSiteData.headerValue(types, label?) #

Build the RFC 9527 §3 Clear-Site-Data header value from a list of directive types — a comma-separated list of double-quoted tokens — validating each against the known set (cookies, storage, cache, executionContexts). The middleware factory and b.session.logout both compose it so every emitter produces the same validated header instead of hand-rolling the quoting. Throws a TypeError on an unknown directive or a non-array input (config-time / entry-point tier).

b.middleware.clearSiteData.headerValue(["cookies", "storage"]);
// → '"cookies", "storage"'

Last updated 2026-08-08T16:39:49.652Z by seeder.