This is the 17th day of my participation in the August Text Challenge.More challenges in August

“Order”

  • As we all know, REST constrains that == servers need to be stateless ==
  • REST is an architectural style that was introduced in 2000, and session predates REST(search the history of cookies through Wikipedia, patent application for cookie technology was filed in 1995).
  • Sessions are stateful, to address the inconvenience of HTTP’s stateless nature: At the time, HTTP’s stateless nature might indeed have seemed inconvenient, since sessions are often used even in today’s small systems.

There are still a lot of systems that use sessions: this is fine for simple systems (monolithic architectures) and may even be easier to develop;

However, when the distributed system does horizontal expansion, because the state only exists in one server, it will cause the problem of not finding the corresponding state

Change state to stateless

State exists independently of the server by passing it to a separate, shareable place.

Like to redis and so on to keep the server “stateless”

Session sharing mechanism – non-sticky session processing mode and session persistence to database are among the five shared session processing strategies in cluster/distributed environment

Two, keep status

The solution is: Distributed shared sessions

That is, the session still exists on the server and can be bound so that incoming requests are always sent to the server that holds their state or replicated so that all servers hold their state

I still recommend 5 shared session processing strategies in cluster/distributed environment, including sticky session, server session replication, session sharing mechanism – sticky session processing, and Session replication implemented by Terracotta

[Attachment] The optimal approach of stateless authentication is recommended: JWT

Authentication is something that almost every system does

Prior to the JWT, we typically took the solution mentioned above, where the server is stateful or has state independent of the server

Authentication becomes easier with JWT, which provides lightweight authorization and authentication specifications for stateless, distributed Authorization of Web applications

Post a nice link to the article, which I won’t repeat here: JWT implements stateless login