The Amazon Web Services (AWS) authentication system is a good example. It uses an HMAC sent in the request headers, so that each request is effectively signed

The Amazon Web Services (AWS) authentication system is a good example. It uses an HMAC sent in the request headers, so that each request is effectively signed by the sender: http://docs.amazonwebservices.com/AWSSimpleQueueService/2006-04-01/RequestAuthenticationArticle.html http://docs.amazonwebservices.com/AWSSimpleQueueService/2006... This allows authentication without any sort of server-side session state, since each request can be authenticated individually. So it can be more horizontally scalable than a stateful session, but it may also be more CPU-intensive on both server and client, since they need to compute a cryptographic hash for every request. Also, the lack of a widely-reviewed standard library for HTTP+HMAC authentication means that you might end up rolling your own, which would probably have security holes that you don't catch, like all the recent timing attack vulnerabilities: http://news.ycombinator.com/item?id=760917 http://news.ycombinator.com/item?id=760917