code: public void removeRequestUrlAndParameters(HttpServletRequest request, HttpServletResponse response) {
          ReferrerURLCookieHandler referrerURLCookieHandler = getCookieHandler();
          referrerURLCookieHandler.invalidateReferrerURLCookie(request, response, ReferrerURLCookieHandler.REFERRER_URL_COOKIENAME);
  
          WebAppSecurityConfig webAppSecConfig = getWebAppSecurityConfig();
          if (isPostDataSavedInCookie(webAppSecConfig)) {
              deleteCookie(request, response, PostParameterHelper.POSTPARAM_COOKIE, webAppSecConfig);
          } else {
              removePostParameterSessionAttributes(request);
          }
      }
docs: Invalidates the original request URL cookie or removes the same respective session attributes, depending on how the data
  was saved.