we more or less need sessions to provide security for users This is not entirely true, SAML tokens are a very good solution for stateless authentication and au

we more or less need sessions to provide security for users This is not entirely true, SAML tokens are a very good solution for stateless authentication and authorization. The nice part is that they can provide third party authorization as well. Session creates so many anti-patterns that it is no wonder that traditional web 1.0 development is in the state it is in. There are a multitude of other solutions out there that provide very clean stateless programming patterns. The problem with session is that once a developer falls on it as a crutch it begins to be used for all manner of bad programming habits. Sun had a very good product called OpenSSO that did stateless authentication and authorization unfortunately it was one of the project Oracle killed off.