Logout link present but no Clear-Site-Data signal - verify logout endpoint clears session

Clear-Site-Data is a response header a logout endpoint can send to tell the visitor's browser to wipe all cookies, cached data, and local storage for the site in one go. This check looks for a logout link on the site and whether the logout process sends this header. On this site, a logout link was found, but no Clear-Site-Data header was detected being returned. Mozilla's Web Security guidelines recommend logout endpoints return this header specifically so a session is genuinely and fully invalidated. Without it, someone using a shared or public device could potentially recover a supposedly logged-out session using the browser's back button, or through data still sitting in local storage after clicking logout. Your developer should add a Clear-Site-Data response header, covering cookies, storage, and cache, to the response returned by the /logout endpoint. Browsers will then purge everything associated with the site's origin atomically as soon as logout happens. This is a small server-side header addition, typically about an hour including testing on a shared or private browser session.