Token-Based Authentication

Cookie-based sessions work well until you have 10 servers behind a load balancer and every one of them needs access to the same session store. You add Redis. Redis goes down at 3 AM and every user is logged out simultaneously. You add Redis Sentinel for failover. Now you are managing infrastructure for something that was supposed to be simple.

Token-based authentication eliminates the server-side session store entirely. Instead of creating a record on the server and giving the client a reference key (the session ID), the server encodes the user's identity directly into a signed token and hands the entire thing to the client. The client sends the token with every request. The server verifies the signature and reads the user data from the token itself. No Redis. No database lookup. No shared state.

This is the stateless model. The server holds no session state between requests. Every request carries everything the server needs to identify the caller. Any server in the cluster can handle any request because verification is a local CPU operation, not a network call to a session store.

Mobile apps drove token adoption faster than anything else. iOS and Android apps do not have a native cookie jar the way browsers do. Setting Authorization: Bearer <token> in a header is natural for mobile. Cookies are not.

The flow:

1. User submits credentials (email + password, or OAuth callback)
2. Server verifies credentials against the database
3. Server generates a signed token containing user identity: {userId: 42, role: "admin", exp: 1712345678}
4. Token sent to client in the response body (NOT in a cookie)
5. Client stores the token (iOS Keychain, Android EncryptedSharedPreferences, or in-memory for web)
6. Client includes the token in every request: Authorization: Bearer eyJhbG...
7. Server verifies the signature and reads claims from the token. No database call.

Stateful vs stateless, a concrete comparison:

Why tokens are NOT inherently more secure than sessions: Tokens eliminate CSRF (because they are not auto-attached) but introduce token storage challenges. If you store a token in localStorage, any XSS payload can steal it. A session cookie with HttpOnly is immune to XSS theft. The security trade-off is real.