title: Does Using Opaque Access Tokens Make My Server Stateful?
body: <p>I am trying to understand statelessness in restful APIs in the context of authentication. Here's the scenario:</p>
  
  <ol>
  <li>The user logs in.</li>
  <li>The server verifies the username and the password, and generates an opaque access token. It caches some information related to this token - for example, the expiration time, the userId, whether this token was explicitly invalidated before it expired, etc.</li>
  <li>The token is sent to the client, and the client sends it with every future request.</li>
  </ol>
  
  <p>List item</p>
  
  <p>Fielding's dissertation defines statelessness as:</p>
  
  <p>"...such that each request from client to server must contain all of the information necessary to understand the request, and cannot take advantage of any stored context on the server. Session state is therefore kept entirely on the client."</p>
  
  <p>In my example, the client is sending the token with every request, so the first condition is satisfied. However, my server has a context associated with this session that is stored in the sessions cache.</p>
  
  <p>Does this make my application stateful?</p>
  
  <p>If yes, then is it that true statelessness be achieved only if we are using JWTs? I am pondering upon this as JWTs are quite new, so how were architects building truly stateless services before they were invented?</p>