It is pretty valuable to my debugging and general observability to log the URLs requested (including query component), which is user-provided data. I'm not say

It is pretty valuable to my debugging and general observability to log the URLs requested (including query component), which is user-provided data. I'm not saying I couldn't maintain my app operations without logging URI's including query strings... but it would definitely be more challenging. Then there's the user-agent header, which also can be pretty valuable to debugging and other operations. Although this one is easier not to log. In my current logs, I'm seeing attempts to compromise log4j vulnerability in both URL query string and user-agent. (Which of course I would not know about if I weren't logging them). This particular application has no Java involved, so is not vulnerable.