Clarify 14.3.1

[tghosth]

Current:

#	Description	Level	#v5.0.be
14.3.1	[MODIFIED] Verify that authenticated data is cleared from client storage, such as the browser DOM, after the client or session is terminated. The "Clear-Site-Data header" may be able to help with this but the client-side should also be able to clear up if the server connection is lost.	1	v5.0.be-8.2.3

@elarlang said:

"without interruption the client-side must be ablo to"

Not sure what the concern is here?

[elarlang]

Concern comes from the fact that whetever is on the client side is under user control.

• The "Clear-Site-Data header" > The 'Clear-Site-Data' header field

[tghosth]

I think the aim here is that there is client side code that deletes client side data. It is in the user's interested to this and if an attacker already has control of the client side then they already have the data anyway so it is game over

[elarlang]

to help with this but the client-side should also be able to clear up if the server connection is lost.

May one interpret, that if the connection is lost, then immediate clean-up must be triggered?

[tghosth]

to help with this but the client-side should also be able to clear up if the server connection is lost.

May one interpret, that if the connection is lost, then immediate clean-up must be triggered?

So no, that is going to cause a problem.

The implication of the requirement is that when the user logs out or when it is expected that a client side data clean would be triggered, the app cannot just rely on the Clear-Site-Data header but rather needs to have client side mechanisms to handle that as well

[elarlang]

Yes, my question was, that if someone only focuses on the last sentence, may it be interpreted like that.

[tghosth]

Ok, I understand. Suggestion:

"[MODIFIED] Verify that authenticated data is cleared from client storage, such as the browser DOM, after the client or session is terminated. The "Clear-Site-Data header" may be able to help with this but the client-side should also be able to clear up if the server connection is not available when the session is terminated."

[elarlang]

PR with tiny modification

#	Description	Level	#v5.0.be
14.3.1	[MODIFIED] Verify that authenticated data is cleared from client storage, such as the browser DOM, after the client or session is terminated. The 'Clear-Site-Data' HTTP response header field may be able to help with this but the client-side should also be able to clear up if the server connection is not available when the session is terminated.	1	v5.0.be-8.2.3