This may be a convoluted question, but I'm trying to get a better understanding of statelessness.Based on what I've read, web applications should be stateless, meaning each request is treated as an independent transaction.  As a result, Session and Cookies should be avoided (as both of them are stateful).  A better approach is to use Tokens, which are stateless because nothing is stored on the server.So I'm trying to understand, how can web applications be stateless when there is data that is being kept for my session (such as items in a shopping cart)?  Are these actually being stored in a database somewhere and then periodically being purged?  How does this work when you are using a token instead of cookies?And then as a related question, are the major websites (Amazon, Google, Facebook, Twitter, etc.) actually stateless?  Do they use tokens or cookies (or both)?
How to keep applications stateless
web applications;state
web applications should be stateless should be understood as web applications should be stateless unless there is a very good reason to have state. A shopping cart is a stateful feature by design, and denying that is quite counter-productive. The whole point of the shopping cart pattern is to preserve the state of the application between requests.An alternative which I could imagine as a stateless website which implements a shopping cart would be a single-page-application which keeps the shopping cart completely client-sided, retrieves product information with AJAX calls and then sends it to the server all at once when the user does a checkout. But I doubt I have ever seen someone actually do that, because it doesn't allow the user to use multiple browser tabs and doesn't preserve state when they accidentally close the tab. Sure, there are workarounds like using localstorage, but then you do have state again, just on the client instead of on the server.Whenever you have a web application which requires to persist data between pageviews, you usually do that by introducing sessions. The session a request belongs to can be identified by either a cookie or by a URL parameter you add to every link. Cookies should be preferred because they keep your URLs more handy and prevent your user from accidentally sharing an URL with their session-id in it. But having URL tokens as a fallback is also vital for users which deactivate cookies. Most web development frameworks have a session handling system which can do this out-of-the-box. On the server-side, session information is usually stored in a database. Server-side in-memory caching is optional. It can greatly improve response time, but won't allow you to transfer sessions between different servers. So you will need a persistent database as a fallback. are the major websites (Amazon, Google, Facebook, Twitter, etc.) actually stateless? Do they use tokens or cookies (or both)?Do they allow you to log in? When you then close the tab and revisit the site, are you still logged in? If you are, then they are using cookies to preserve your identity between sessions. 