CyberCertPrepWeb App FundamentalsAPIs & RESTEASYFree question
What does it mean for a REST API to be 'stateless', and what security implication does this have?
- A.Stateless means the API does not use HTTPS because state is not preserved
- B.Stateless means no cookies can be used because cookies maintain state
- C.Stateless means the API returns the same response regardless of who calls it
- D.Stateless means each request must contain all information needed to process it (no server-side session state); the security implication is that every request must include authentication credentials (token, API key) since the server retains no memory of previous authenticated requests
Why D is correct
REST statelessness means the server processes each request in isolation with no knowledge of previous interactions. For security, this means every request must be authenticated independently - the server cannot remember that the previous request was authenticated. This forces consistent auth checking on every request and makes horizontal scaling easier, but also means there's no server-side session to immediately invalidate (a JWT weakness). Each request must include a valid, unexpired credential.
Know someone studying for Web App Fundamentals? Send them this one.