Questions
7 of 25
1How do you implement a local (username/password) Passport strategy in NestJS?
2How do you register a global JWT guard so all routes are protected by default in NestJS?
3What is RBAC and how do you implement a basic roles guard in NestJS?
4What is the difference between RBAC and ABAC and when would you use each in NestJS?
5How does the OAuth2 authorization code flow work and how do you implement it with Passport in NestJS?
6How do you implement API key authentication as an alternative to JWT in NestJS?
7How do you implement multi-tenant authentication where each tenant has its own JWT secret in NestJS?
8How do you implement JWT refresh token rotation with secure storage in NestJS?
9How do you implement ABAC with CASL in a NestJS application?
10What is the difference between JWT and session-based authentication and when do you choose each in NestJS?
11How do you implement two-factor authentication (2FA) with TOTP in NestJS?
12How do you implement permission-based authorization at the field level in a GraphQL resolver in NestJS?
13How do you test authentication guards and strategies in NestJS?
14What is Passport.js and how does it integrate with NestJS?
15How do you implement row-level (resource-level) authorization to ensure users can only access their own records in NestJS?
16What is PKCE and when is it required in OAuth2 flows in NestJS?
17How do you implement an OAuth2 Authorization Server in NestJS?
18How do you implement session-based authentication in NestJS?
19How does the validate() method in a Passport strategy relate to the NestJS request lifecycle?
20How do you implement JWT authentication in NestJS with access and refresh tokens?
21What should and should not go inside a JWT payload?
22How do you implement JWT token revocation (blacklisting) without a database lookup on every request in NestJS?
23What is the difference between AuthGuard('jwt') from Passport and writing a custom JwtAuthGuard in NestJS?
24How do you secure session cookies against common attacks (CSRF, XSS, session fixation) in NestJS?
25How do you implement brute force protection on the login endpoint in NestJS?
NestJSNestJS
Basics
Modules
Decorators
Controllers
Dependency Injection
Providers
Architecture
Request Lifecycle
Middleware
Guards
Interceptors
Pipes
Filters
Exception Handling
API Design
GraphQL
Database and ORM
Microservices
Authentication and Authorization
07 / 25

How do you implement multi-tenant authentication where each tenant has its own JWT secret in NestJS?

Use the secretOrKeyProvider option in PassportStrategy to perform a dynamic secret lookup. Decode the token without verifying it to extract the tenantId, look up the tenant's secret, and return it to Passport for signature verification. This is safe because the secret is used for verification, not trust.

Multi-tenant JWT strategy with dynamic secret provider
Multi-tenant JWT security notes:
  1. 1

    Decoding without verifying to read tenantId is safe — the payload is only used to look up the verification secret.

  2. 2

    The signature is verified by Passport after secretOrKeyProvider returns the correct secret.

  3. 3

    validate() confirms the user belongs to the tenant in the token — prevents cross-tenant token reuse.

  4. 4

    Use a different signing key per tenant — a compromised tenant's secret does not affect other tenants.

  5. 5

    Cache tenant secrets with a short TTL to avoid a database lookup on every request.

Difficulty: 7/10
Topics: JWT, multi-tenant authentication, NestJS guards

Scenario Questions

0-2 years experience
  1. 1

    We have a NestJS microservice that needs to issue JWTs for two tenants, each with its own secret. How would you set up the AuthModule to load the correct secret based on the incoming request?

  2. 2

    If a request includes a tenant identifier in a custom header, what steps would you take to verify the JWT using that tenant's secret?

2-5 years experience
  1. 1

    You added a dynamic JWT secret per tenant, but after deployment some tokens are being rejected for a specific tenant. Walk me through how you'd debug the issue.

  2. 2

    Explain the trade‑offs between storing tenant secrets in environment variables versus a database when implementing per‑tenant JWT validation in NestJS.

5-8 years experience
  1. 1

    At scale we have thousands of tenants and need to validate JWTs efficiently. How would you design the secret‑lookup mechanism to avoid performance bottlenecks and keep the AuthGuard stateless?

  2. 2

    Consider a scenario where a tenant rotates its secret while users still have active tokens signed with the old secret. How would you handle secret rotation without breaking existing sessions?

8+ years experience
  1. 1

    Our platform is moving from a single‑tenant JWT secret to a multi‑tenant model across multiple services. What architectural changes would you propose to keep authentication consistent and maintainable across teams?

  2. 2

    Discuss the long‑term security and operational implications of storing per‑tenant JWT secrets in a centralized secret manager versus embedding them in each service's config.

Follow-up Questions

  • ❓What would you do if the tenant identifier header is missing or malformed?
  • ❓How would you write unit and integration tests for this multi‑tenant auth flow?
  • ❓Can you outline how you would monitor the latency of secret look‑ups in production?