1 because the server does not save the login information of the user, stateless Token has to verify every visit, isn"t it very expensive to decrypt?
2 I have seen that stateless token can use hashing algorithm, but hashing algorithm is only an encrypted string after hashing, and it cannot be decrypted and restored to the original string, so how to verify it? The server does not keep the relevant information.