Technologies Coding Problems Bookmarks Learning Paths Login

Technologies Coding Problems Bookmarks Learning Paths Login

</>

Loading Topics...

AI-powered interview preparation platform. Practice with curated questions, mock interviews, and personalized learning paths to crack your dream tech interview.

Quick Links

Technologies
Mock Interviews
Saved Questions
Pricing

Company

About Us
Contact Us

Legal

Privacy Policy
Terms of Use

© 2026 nextRound. All rights reserved.

TOPIC OVERVIEW

NestJS/Authentication and Authorization

Make sure users are who they claim to be and control exactly what each user is allowed to access.

20 QuestionsAdvancedHigh Priority ~15 min read

Authentication answers the question "Who are you?", while authorization answers "What are you allowed to do?". A NestJS application often combines authentication strategies, tokens or sessions, guards, and user roles or permissions to protect its APIs.

A common flow is to authenticate a user, attach their identity to the request, and then use guards to decide whether that user can access a specific resource. Good security also requires careful handling of passwords, tokens, sessions, permissions, and sensitive data.

What you'll walk away knowing

The difference between authentication and authorization

How authentication strategies and tokens fit together

How guards protect routes and enforce permissions

How role-based and permission-based access control works

1How do you implement a local (username/password) Passport strategy in NestJS?ExpertHigh 2How do you register a global JWT guard so all routes are protected by default in NestJS?ExpertHigh 3What is RBAC and how do you implement a basic roles guard in NestJS?ExpertHigh 4What is the difference between RBAC and ABAC and when would you use each in NestJS?ExpertHigh 5How does the OAuth2 authorization code flow work and how do you implement it with Passport in NestJS?ExpertHigh 6How do you implement API key authentication as an alternative to JWT in NestJS?ExpertHigh 7How do you implement multi-tenant authentication where each tenant has its own JWT secret in NestJS?ExpertHigh 8How do you implement JWT refresh token rotation with secure storage in NestJS?ExpertHigh 9How do you implement ABAC with CASL in a NestJS application?ExpertHigh 10What is the difference between JWT and session-based authentication and when do you choose each in NestJS?ExpertHigh 11How do you implement two-factor authentication (2FA) with TOTP in NestJS?ExpertHigh 12How do you implement permission-based authorization at the field level in a GraphQL resolver in NestJS?ExpertHigh 13How do you test authentication guards and strategies in NestJS?ExpertHigh 14What is Passport.js and how does it integrate with NestJS?ExpertHigh 15How do you implement row-level (resource-level) authorization to ensure users can only access their own records in NestJS?ExpertHigh 16What is PKCE and when is it required in OAuth2 flows in NestJS?ExpertHigh 17How do you implement an OAuth2 Authorization Server in NestJS?ExpertHigh 18How do you implement session-based authentication in NestJS?ExpertHigh 19How does the validate() method in a Passport strategy relate to the NestJS request lifecycle?ExpertHigh 20How do you implement JWT authentication in NestJS with access and refresh tokens?ExpertHigh 21What should and should not go inside a JWT payload?ExpertHigh 22How do you implement JWT token revocation (blacklisting) without a database lookup on every request in NestJS?ExpertHigh 23What is the difference between AuthGuard('jwt') from Passport and writing a custom JwtAuthGuard in NestJS?ExpertHigh 24How do you secure session cookies against common attacks (CSRF, XSS, session fixation) in NestJS?ExpertHigh 25How do you implement brute force protection on the login endpoint in NestJS?ExpertHigh

All Topics

1

Dependency Injection

2

Request Lifecycle

Exception Handling

3

4

Database and ORM

5

Authentication and Authorization