"Normally" ? What refrain you from logging HTTP Body ? It's the same problem as logging HTTP query string. You should consider everything you send over HTTPS public for the receiver in any way.