Information
The RECYCLE_FACADES can specify if a new facade will be created for each request. If a new facade is not created there is a potential for information leakage from a prior session.
Rationale:
When RECYCLE_FACADES is set to false, Tomcat will recycle the session facade between requests which may result in information leakage.
Solution
To start Tomcat with RECYCLE_FACADES set to true, add Dorg.apache.catalina.connector.RECYCLE_FACADES=true to your startup script.
Default Value:
The default value is false.
References:
https://tomcat.apache.org/tomcat-8.0-doc/config/systemprops.html
https://tomcat.apache.org/tomcat-8.0-doc/security-howto.html