TOPIC OVERVIEW

NestJS/Authentication and Authorization

Make sure users are who they claim to be and control exactly what each user is allowed to access.

20 QuestionsAdvancedHigh Priority ~15 min read

Authentication answers the question "Who are you?", while authorization answers "What are you allowed to do?". A NestJS application often combines authentication strategies, tokens or sessions, guards, and user roles or permissions to protect its APIs.

A common flow is to authenticate a user, attach their identity to the request, and then use guards to decide whether that user can access a specific resource. Good security also requires careful handling of passwords, tokens, sessions, permissions, and sensitive data.

What you'll walk away knowing

The difference between authentication and authorization

How authentication strategies and tokens fit together

How guards protect routes and enforce permissions

How role-based and permission-based access control works

1How do you register a global JWT guard so all routes are protected by default in NestJS?Intermediate 2How do you implement a local (username/password) Passport strategy in NestJS?Intermediate 3How do you implement API key authentication as an alternative to JWT in NestJS?Intermediate 4How do you implement JWT authentication in NestJS with access and refresh tokens?Intermediate 5What is the difference between AuthGuard('jwt') from Passport and writing a custom JwtAuthGuard in NestJS?Intermediate 6What is RBAC and how do you implement a basic roles guard in NestJS?Intermediate 7How do you implement JWT token revocation (blacklisting) without a database lookup on every request in NestJS?Advanced 8How do you implement brute force protection on the login endpoint in NestJS?Intermediate 9What is PKCE and when is it required in OAuth2 flows in NestJS?Intermediate 10What is Passport.js and how does it integrate with NestJS?Intermediate 11How do you implement session-based authentication in NestJS?Intermediate 12How do you implement two-factor authentication (2FA) with TOTP in NestJS?Intermediate 13How do you secure session cookies against common attacks (CSRF, XSS, session fixation) in NestJS?Intermediate 14What is the difference between RBAC and ABAC and when would you use each in NestJS?Intermediate 15How do you implement row-level (resource-level) authorization to ensure users can only access their own records in NestJS?Intermediate 16How does the validate() method in a Passport strategy relate to the NestJS request lifecycle?Intermediate 17How do you test authentication guards and strategies in NestJS?Intermediate 18How do you implement JWT refresh token rotation with secure storage in NestJS?Advanced 19What is the difference between JWT and session-based authentication and when do you choose each in NestJS?Intermediate 20How do you implement ABAC with CASL in a NestJS application?Advanced 21How do you implement permission-based authorization at the field level in a GraphQL resolver in NestJS?Intermediate 22How does the OAuth2 authorization code flow work and how do you implement it with Passport in NestJS?Intermediate 23How do you implement an OAuth2 Authorization Server in NestJS?Advanced 24What should and should not go inside a JWT payload?Intermediate 25How do you implement multi-tenant authentication where each tenant has its own JWT secret in NestJS?Advanced

All Topics

1

Dependency Injection

2

Request Lifecycle

Exception Handling

3

4

Database and ORM

5

Authentication and Authorization

Sharethis topic

Share via WhatsApp, X, Facebook, LinkedIn or copy link. Open Graph preview enabled.