title: OAuth 2.0. No session? (stateless)
body: <p>I'm going to implement <strong>OAuth 2.0</strong> and <strong>REST API</strong> with it</p>
  
  <p>to grant different permissions per users and also to scale well.</p>
  
  <p>To scale well, <strong>stateless</strong> is easier because there is </p>
  
  <p><strong>NO</strong> file, database, in-memory based session with it.</p>
  
  <hr>
  
  <p>Below is how I understand OAuth 2.</p>
  
  <ol>
  <li>OAuth Server give an access token to a user.</li>
  <li>The user's access token is stored in cookie.</li>
  <li>When user access to REST API, user sends with the access token.</li>
  <li>Server receives request with access token.</li>
  <li>Server find out whether access token is valid and the user has permission to do request.</li>
  <li>Do or reject based on user's privilege.</li>
  </ol>
  
  <hr>
  
  <p>So I do not have to worry about session storage. Right?</p>