We don't log all headers. By default, we don't log headers that are likely to contain credentials (Cookie, Set-Cookie, Authorization, Proxy-Authorization): https://github.com/caddyserver/caddy/blob/a8cc5d1a7d9d80e12a...