Understanding Statelessness in REST APIs

Introduction

I was recently asked in an interview to explain what it means when they say a REST API is stateless, but I found it a bit difficult to explain at first. I knew what it meant, but initially, I found it difficult to explain, so I decided to write this article to explain what it means when they say a REST API is stateless. But first, what is a REST API?

API is an acronym for Application Programming Interface, and it is a way for 2 computers (usually called a client and server) to talk to each other. REST is an acronym for Representational State Transfer, and it is a set of rules for building web APIs.

Put together, a REST API can simply be defined as an API that follows the REST principle. There are 5 key principles of REST APIs:

• Stateless: Each request from the client must contain all the information needed to understand and process the request.

• Client/Server: REST APIs are based on the client-server model, in which they are separated and handle different concerns. The client handles the user interface. The server manages data and business logic.

• Uniform Interface: REST APIs maintain a uniform interface, following a set of conventions, such as standard HTTP methods (POST, GET, etc), resource identification through the use of Uniform Resource Indicators (URIs), and a consistent response format (JSON or XML).

• Layered Architecture: REST APIs can be composed of multiple layers that offer specific functions. As such, the client (or the server) doesn’t know if it is communicating with the server (or the client) or an intermediary.

• Cacheable: Responses from the server can each indicate whether they can be cached or not, and for how long.

In this article, we'll focus on statelessness so let's dive deeper.

What is Statelessness?

Stateless or stateful refers to how state is managed within an application. Within the context of REST API, when we say REST API is stateless, it means no information about the client is stored in memory, so the server doesn’t rely on past interactions to process a new request.

As such, when the client sends a request, it must include all the necessary information for the server to understand and process that request. This is quite different from a stateful system, where the server stores data, and that stored data or information is used to process future requests from the client. As a result, in a stateful system, the client doesn't always have to include all the information for the server to process a request.

A typical example is when a user wants to access a protected route. In a stateless system, the server has no memory of whether the user has logged in before, so the client must include, perhaps, a token to identify the user with every request. In contrast, a stateful system might create and store a session ID after login, so the server can recognise the user in subsequent requests.

In practice, this means the client takes full responsibility for managing its state. Typically, by storing a token after login and including it in each request via headers like Authorization: Bearer <token>. The server then validates the token, processes the request, and forgets everything once the response is sent.

Why Statelessness Matters in REST

Statelessness has several advantages in REST. Let's discuss some of them.

1. Reliability: The first advantage of statelessness in REST APIs that I'll like to talk about is reliability. Suppose a server crashes; when it recovers, it can continue to handle requests seamlessly as if nothing happened. This is because it doesn't rely on any prior information instead it relies on the client providing all the information needed to process a request.

2. Scalability: With statelessness, there is no need to tie a user to a specific server that remembers their session as any server can handle any request. This makes it easy to scale horizontally that is, add more servers.

3. Improved Performance: An improved performance is realised as the server doesn't have to store the client's requests or sessions in memory.

4. Simplicity: Each request is independent, so this makes the API to understand and debug if there's a problem.

Conclusion

In summary, when we say a REST API is stateless, we mean that every request from the client must contain all the necessary information for the server to understand and fulfil the request, because the server doesn’t remember anything from previous requests. This stateless nature makes REST APIs more scalable, reliable, and easier to debug.