Is it a hybrid authentication system?

[d3crypt3d]

Hello.
As I know, token-based authentication system assumes stateless server-side, which means no session is persisted. But I discovered it still uses sessions under the hood. Seems because it is build on the top of Devise, which, in turn, uses Warden's functionality. If it's true, which piece of information is stored in a session variable and which one in the token (in comparison with traditional Device)?
Thanks in advance.

[rdupz]

+1

[lynndylanhurley]

I think Omniauth is the only part of this system that uses session storage.

In this chain of events:

Client -> Rails API -> Provider Auth -> Rails API -> Client

Session storage is used when going from the Rails API to the Provider and back.