For folks running #Tomcat in Production, you may not be aware that there's an opportunity for it to log (potentially sensitive) cookies out-of-the-box - I've shared how you can resolve it in https://www.jvt.me/posts/2020/04/07/tomcat-cookie-disclosure/