Clear-Site-Data and bfcache

[domenic]

Should clear-site-data ever clear bfcache? /cc @fergald

Based on name/intent, I think executionContexts and cache might be good reasons to clear bfcache. (And arguably bfcache falls into the unspecified step 4 of cache.) But, I guess cache might be going away, er #68? And, per #59, nobody implements executionContexts?

We've run into some scenarios where people want to clear bfcache on logout. (I think @fergald can elaborate.) We thought using clear-site-data would be a good tool for this, but now I'm kind of confused.

[annevk]

A new keyword could maybe work. Not entirely sure how it should work in terms of scope. (E.g., A embeds B1 and gets bfcached, then navigates to B2 which clears. Is A cleared?)

See also whatwg/html#5744.

cc @cdumez

[fergald]

When I talked to @domenic about this, I did not know that executionContexts was unimplemented by everyone. It seems like BFCached content should not survive if other tabs are getting reloaded.

We can also say that sites can all just handle this in the pageshow handlers if they really care although having main frames things reload as their come out of BFCache seems like a step backwards.

[fergald]

Since Safari and Chrome have already shipped BFCache clearing with cache and FF have removed cache, what should we do? Update the spec for cache?

[westonruter]

Curious if there's any planned movement on this? I'm currently working on getting bfcache enabled for authenticated responses in WordPress (ticket). In order to address the privacy concern of someone being able to access authenticated pages via bfcache once the user has logged-out, there's a pageshow event handler (script) that watches for the persisted state, and then destroys the page with a reload if the "bfcache session token" cookie has changed. It should be much nicer to simply be able to do something like this when logging out instead:

Clear-Site-Data: bfcache

[anthonyryan1]

@westonruter so there has been a lot of movement on this, but it's all happened as part of "cache" rather than "bfcache".

As far as I can tell, all major browsers now implement bfcache clearing when using:

Clear-Site-Data: "cache"

• Web Platform Test: [Gecko Bug 1930501] Implement bfcache clearing for Clear-Site-Data: "cache"-header web-platform-tests/wpt#53153
• Safari 16.4+: Clear-Site-Data: "cache" HTTP header should clear the back/forward cache WebKit/WebKit#4617
• Firefox 141+: https://bugzilla.mozilla.org/show_bug.cgi?id=1930501
• Chrome 115+: https://issues.chromium.org/issues/40262309

[westonruter]

@anthonyryan1 Thank you. It seems the main blocker then for sites to use this is Chromium bug 40233601 "Clear-Site-Data cache deletion is still slow"?

[anthonyryan1]

That does match up with my experience.

I've deployed it in production, on logout pages, and even with <100 KB of assets cached. The logout action I'm using takes 4.5 seconds in Chrome, even though it's ~50 ms instant in Firefox.

Personally, I'm willing to make the users eat that time when they click logout, because the actual server-side logout that I care about as a site operator still completed just as fast.

Thanks for that link. I've CC'd myself on further developments there. I had observed it took noticeably longer, but I didn't stop to consider it a bug.