How do you implement a local (username/password) Passport strategy in NestJS?

Q: How do you implement a local (username/password) Passport strategy in NestJS?

// local.strategy.ts @Injectable() export class LocalStrategy extends PassportStrategy(Strategy, 'local') { constructor(private authService: AuthService) { super({ usernameField: 'email' }); // default field is 'username' } async validate(email: string, password: string): Promise { const user = await this.authService.validateUser(email, password); if (!user) throw new UnauthorizedException('Invalid credentials'); return user; // attached to request.user } } // auth.service.ts @Injectable() export class AuthService { async validateUser(email: string, password: string): Promise { const user = await this.usersService.findByEmail(email); if (!user) return null; const valid = await bcrypt.compare(password, user.password); return valid ? user : null; } } // auth.controller.ts @Post('login') @UseGuards(AuthGuard('local')) // runs LocalStrategy.validate() login(@Request() req) { return this.authService.login(req.user); // user set by strategy } Pass { usernameField: 'email' } to super() when the login field is named email instead of username. validate() throws UnauthorizedException to reject — returning null also triggers a 401 via handleRequest(). Never compare passwords with === — always use bcrypt.compare() for timing-safe hash comparison. validate() return value is attached to request.user before the controller handler runs. AuthGuard('local') must be on the login route — do not put it on the register or other routes.

Difficulty: 5/10

Passport local strategy, NestJS AuthGuard, Password hashing

Extend PassportStrategy(Strategy, 'local') and implement validate(username, password). Call the strategy from a login route using @UseGuards(AuthGuard('local')). The validate() method receives credentials extracted by Passport, verifies them via AuthService, and returns the user object that becomes request.user.

LocalStrategy, AuthService validation, and login controller

Local strategy implementation rules:

1
Pass { usernameField: 'email' } to super() when the login field is named email instead of username.
2

How do you implement a local (username/password) Passport strategy in NestJS?

Difficulty: 5/10

Passport local strategy, NestJS AuthGuard, Password hashing

Extend PassportStrategy(Strategy, 'local') and implement validate(username, password). Call the strategy from a login route using @UseGuards(AuthGuard('local')). The validate() method receives credentials extracted by Passport, verifies them via AuthService, and returns the user object that becomes request.user.

LocalStrategy, AuthService validation, and login controller

Local strategy implementation rules:

1
Pass { usernameField: 'email' } to super() when the login field is named email instead of username.
2

How do you implement a local (username/password) Passport strategy in NestJS?

How do you implement a local (username/password) Passport strategy in NestJS?

Scenario Questions

Follow-up Questions