The most simple way is to store the session information in some key-value store. Have a look here: Tomcat: Store session in database
To go "real" stateless, there must be NO session at all. This means: The user will authenticate with every request, and with every request you've got to check the credentials. (It's pretty similar to a session database)