Why prefer stateless services and how do you handle sessions?

// Where does the session live? Four answers, simulated in one process.
// "Instances" are objects, the "load balancer" is a function, the shared
// store is a Map standing in for Redis. No network, no real HTTP.
const crypto = require("crypto");

function makeCluster() {
  return [1, 2, 3].map((n) => ({ name: "inst-" + n, up: true, memory: new Map() }));
}
let counter = 0;
const newId = () => "sess-" + ++counter;

function roundRobin(cluster) {
  let i = 0;
  return () => {
    for (;;) { const inst = cluster[i++ % cluster.length]; if (inst.up) return inst; }
  };
}
function crash(inst) { inst.up = false; inst.memory.clear(); }

console.log("A) Session in instance memory, round-robin LB");
let cluster = makeCluster(), pick = roundRobin(cluster);
let inst = pick(), sid = newId();
inst.memory.set(sid, { user: "alice" });
console.log("  login  -> " + inst.name + " stores " + sid);
for (let i = 0; i < 3; i++) {
  inst = pick();
  console.log("  /cart  -> " + inst.name + (inst.memory.has(sid) ? " 200 alice" : " 401 who are you?"));
}

console.log("B) Session in instance memory, sticky LB");
cluster = makeCluster(); pick = roundRobin(cluster);
const sticky = new Map(); // session id -> instance (what a sticky cookie encodes)
const route = (id) => { const s = sticky.get(id); if (s && s.up) return s; const n = pick(); sticky.set(id, n); return n; };
sid = newId();
inst = route(sid); inst.memory.set(sid, { user: "alice" });
console.log("  login  -> " + inst.name + " stores " + sid);
inst = route(sid); console.log("  /cart  -> " + inst.name + (inst.memory.has(sid) ? " 200 alice" : " 401"));
crash(cluster[0]); console.log("  inst-1 crashes (deploy, OOM, scale-in)");
inst = route(sid); console.log("  /cart  -> " + inst.name + (inst.memory.has(sid) ? " 200 alice" : " 401 session lost"));

console.log("C) Session in a shared store, any instance");
cluster = makeCluster(); pick = roundRobin(cluster);
const store = new Map(); // stands in for Redis: SET sid value EX ttl
sid = newId(); inst = pick(); store.set(sid, { user: "alice" });
console.log("  login  -> " + inst.name + " writes " + sid + " to the store");
crash(cluster[0]); console.log("  inst-1 crashes");
for (let i = 0; i < 2; i++) {
  inst = pick();
  console.log("  /cart  -> " + inst.name + (store.has(sid) ? " 200 " + store.get(sid).user : " 401"));
}
store.delete(sid); inst = pick();
console.log("  logout deletes the key; /cart -> " + inst.name + (store.has(sid) ? " 200" : " 401"));

console.log("D) Signed token (JWT-shaped, HS256), nothing stored server-side");
const SECRET = "demo-secret-shared-by-all-instances";
const b64 = (s) => Buffer.from(s).toString("base64url");
const sign = (data) => crypto.createHmac("sha256", SECRET).update(data).digest("base64url");
function issue(claims) {
  const body = b64(JSON.stringify({ alg: "HS256", typ: "JWT" })) + "." + b64(JSON.stringify(claims));
  return body + "." + sign(body);
}
const denylist = new Set();
function verify(token, now) {
  const [h, p, sig] = token.split(".");
  const good = Buffer.from(sign(h + "." + p)), got = Buffer.from(sig);
  if (good.length !== got.length || !crypto.timingSafeEqual(good, got)) return "401 bad signature";
  const claims = JSON.parse(Buffer.from(p, "base64url").toString());
  if (now >= claims.exp) return "401 expired";
  if (denylist.has(claims.jti)) return "401 revoked";
  return "200 " + claims.sub + " (" + claims.role + ")";
}
const token = issue({ sub: "alice", role: "user", exp: 1900, jti: "t-1" });
console.log("  token: " + token);
console.log("  bytes in every request: " + token.length);
console.log("  inst-2 verifies at t=1000: " + verify(token, 1000));
const [h, , s] = token.split(".");
const forged = h + "." + b64(JSON.stringify({ sub: "alice", role: "admin", exp: 1900, jti: "t-1" })) + "." + s;
console.log("  role changed to admin:    " + verify(forged, 1000));
console.log("  user logs out at t=1100, token still: " + verify(token, 1100));
denylist.add("t-1");
console.log("  with jti on a denylist:   " + verify(token, 1100));
denylist.clear();
console.log("  at t=1900 (exp reached):  " + verify(token, 1900));