Clear-Site-Data header on logout

Logout routes that invalidate server-side sessions but don't send Clear-Site-Data leave credentials and sensitive data in the browser's cookie jar, cache, localStorage, and sessionStorage. On a shared device — a library computer, a family laptop, a corporate workstation — the next user can often access the previous user's session by navigating to the application or inspecting browser storage. CWE-613 (Insufficient Session Expiration) and CWE-384 (Session Fixation) both apply. OWASP A07 (Identification and Authentication Failures) explicitly calls out incomplete session termination as an authentication failure — server-side logout without client-side cleanup is not a complete logout.

Add the Clear-Site-Data response header to your logout route handler. Set all three values to ensure complete browser-side cleanup.

// src/app/api/auth/signout/route.ts
export async function POST(req: Request) {
  // Invalidate server-side session first
  await invalidateSession(req)

  return new Response(null, {
    status: 200,
    headers: {
      'Clear-Site-Data': '"cache", "cookies", "storage"'
    }
  })
}

The header value uses quoted strings with commas: "cookies" clears session cookies, "cache" removes cached authenticated responses, "storage" wipes localStorage, sessionStorage, and IndexedDB. Test on Chrome DevTools Network tab — you should see the header in the logout response and verify storage is cleared in the Application panel.