So how do you revoke sessions? There’s no way to logout or invalidate sessions? That may be okay for your use case but it means if a session token is ever leaked it can be used presumably forever. I would recommend maintaining a table of active sessions in the DB and periodically checking the client’s session token against that. That way you avoid DB queries on each request (session is verified cryptographically), but every X minutes you check that the session is still valid by asking the DB.

I’m not sure what you mean by stateless server. The server keeps state regardless of whether you use a session verified by the database or verified by encryption.