Stateless API

Understand the idea

The personal backend does not rely on a login HTTP session. Each todo request supplies a token that is verified independently. Data still persists in MongoDB; stateless authentication does not mean the application stores no data.

A concrete example

SessionCreationPolicy.STATELESS
+ Authorization header on every todo request

In the application

The React app clears its in-memory token on logout or reload. The server validates JWT lifetime independently.

Clearing browser state does not revoke a copied token. This lab has no server-side token revocation or refresh-token flow.

Related concepts

• JWT · JSON Web Token
• Bearer token
• Authentication