HTTP is described as a stateless protocol. What does that mean, and how do web apps still keep a user logged in?

Stateless means the server understands each request on its own. The protocol does not require the server to remember anything about earlier requests, even on the same connection. So, in principle, any server instance can handle any request.

Apps add state on top of HTTP. There are two common ways:

• A session cookie. The cookie holds a session ID. The ID points to the user's data in a store on the server.
• A token. The client sends a token in the Authorization header on every request.

In both cases, the client sends the identifying information again with each request. The server then looks it up or verifies it.

Statelessness makes HTTP easy to scale horizontally, which means adding more servers. It also makes HTTP easy to cache. The reason is that middle servers, like proxies and caches, do not need any history of the conversation to handle a request.