Short version: Is it not recommended to store sessionId in log files/database in plaintext (considering it may put active sessions at risk)? If yes, why do I see many queries on how to log sessionId?
Details: I have come across multiple resources related to security engineering which discuss why we should not log the sessionId in to application log files or store it in DB in plaintext format. For example, this is one of them - https://www.stigviewer.com/stig/application_security_and_development/2017-12-18/finding/V-69363. It recommends some kind of use of some hashed values to identify unique sessions.
However, while I was working with Spring Security library (one of the most prominent one in Java platform), I could find the session Id in plaintext was available in the logs in DEBUG mode. This value was the exact JSESSIONID that I received in Set-Cookie header of the response.
In addition, I could also find several queries and resolutions related to logging the session Id in apache, logging frameworks etc. in the internet.
Looking at these, I am now confused if it really not a good practice to log the session Id. Could somebody please provide some more clarity.