4 ms·
Correct. I can assert a validity of the token without touching any database. Not only that, but the API does not even need to compute what it is. That's what ma
by notyourday 7y ago
Correct. I can assert a validity of the token without touching any database. Not only that, but the API does not even need to compute what it is. That's what makes it stateless.
- jakelazaroff 7y agoIt’s not stateless, you’re just trading a database for “tags”. This is exactly the same as if you just placed a stateful authentication service that checks a database in front of your API. How do you think the CDN works?
- notyourday 7y agoYou do not maintain the tags. You compute the tags and you do not care what so ever if the tag ever matches anything.
- jakelazaroff 7y agoIt doesn’t matter who maintains them — the tags are still state. It may be stateless from your API’s perspective, but the system as a whole is still stateful.
- kelnos 7y agoI guess the idea is that it's "stateless" in the sense that you don't have to maintain the state yourself, and the CDN will do it for you? I mean... okay, I guess the point of being stateless is that you don't want to deal with the scaling and reliability issues around storing state, so pushing that responsibility onto a third party (whose uptime is required to get to your site anyway) is "stateless" from your perspective. I certainly wouldn't call that "stateless", but it does fulfill the main reason why you might want to be stateless, that you don't have to maintain any state yourself.
- notyourday 7y agoThe reason why it is stateless is because there's no state associated with a token that I have to maintain.
- jakelazaroff 7y agoExactly — it's basically the same as writing your own separate authentication service, or using Auth0/Cognito/Firebase.