0
Jump into concepts and practice - no test required
Recommended
Stateless authentication lets a server check who you are without saving your info between requests. This makes apps faster and easier to scale.
1. Client sends login info to server. 2. Server verifies and creates a token (like JWT). 3. Server sends token back to client. 4. Client sends token with each request in headers. 5. Server checks token to allow or deny access.
The token usually contains user info and expiry time.
Server does not keep any session data; it trusts the token.
POST /login
Request Body: {"username": "user", "password": "pass"}
Response: {"token": "eyJhbGciOiJI..."}GET /profile
Headers: Authorization: Bearer eyJhbGciOiJI...
Response: {"name": "User", "email": "user@example.com"}This simple Spring Boot app shows stateless auth. The login returns a token string. The profile endpoint checks the token in the Authorization header. No session is stored on the server.
package com.example.demo; import org.springframework.boot.SpringApplication; import org.springframework.boot.autoconfigure.SpringBootApplication; import org.springframework.web.bind.annotation.*; import jakarta.servlet.http.HttpServletRequest; @SpringBootApplication @RestController public class DemoApplication { public static void main(String[] args) { SpringApplication.run(DemoApplication.class, args); } // Simulate login endpoint @PostMapping("/login") public String login(@RequestParam String username, @RequestParam String password) { if ("user".equals(username) && "pass".equals(password)) { // In real app, create JWT token here return "token12345"; // simple token for demo } return "Invalid credentials"; } // Protected endpoint @GetMapping("/profile") public String profile(HttpServletRequest request) { String authHeader = request.getHeader("Authorization"); if (authHeader != null && authHeader.equals("Bearer token12345")) { return "{\"name\": \"User\", \"email\": \"user@example.com\"}"; } return "Unauthorized"; } }
Tokens should be signed and encrypted in real apps for security.
Tokens usually expire after some time to reduce risk.
Always send tokens over HTTPS to keep them safe.
Stateless authentication uses tokens to identify users without server memory.
Clients send tokens with each request to prove who they are.
This method helps apps scale and stay simple.
@GetMapping("/profile")
public ResponseEntity<String> getProfile(@RequestHeader("Authorization") String authHeader) {
if (authHeader == null || !authHeader.startsWith("Bearer ")) {
return ResponseEntity.status(401).body("Unauthorized");
}
String token = authHeader.substring(7);
if (token.equals("valid-token")) {
return ResponseEntity.ok("User Profile Data");
} else {
return ResponseEntity.status(403).body("Forbidden");
}
}Authorization: Bearer valid-token?public boolean isValidToken(String token) {
if (token == null || token.isEmpty()) {
return false;
}
// Token validation logic
return token.equals("valid-token");
}
public void doFilter(HttpServletRequest req, HttpServletResponse res) {
String auth = req.getHeader("Authorization");
if (auth != null && auth.startsWith("Bearer ")) {
String token = auth.substring(7);
if (!isValidToken(token)) {
res.setStatus(401);
}
}
// Continue filter chain
}