Your only approach is to wrap the HttpServletResponse object so that the addCookie methods can intercept and log when cookies are set. You can do this by adding a ServletFilter which wraps the existing HttpServletResponse before it is passed into your Servlet.