Questions
17 of 25
1How do you implement a local (username/password) Passport strategy in NestJS?
2How do you register a global JWT guard so all routes are protected by default in NestJS?
3What is RBAC and how do you implement a basic roles guard in NestJS?
4What is the difference between RBAC and ABAC and when would you use each in NestJS?
5How does the OAuth2 authorization code flow work and how do you implement it with Passport in NestJS?
6How do you implement API key authentication as an alternative to JWT in NestJS?
7How do you implement multi-tenant authentication where each tenant has its own JWT secret in NestJS?
8How do you implement JWT refresh token rotation with secure storage in NestJS?
9How do you implement ABAC with CASL in a NestJS application?
10What is the difference between JWT and session-based authentication and when do you choose each in NestJS?
11How do you implement two-factor authentication (2FA) with TOTP in NestJS?
12How do you implement permission-based authorization at the field level in a GraphQL resolver in NestJS?
13How do you test authentication guards and strategies in NestJS?
14What is Passport.js and how does it integrate with NestJS?
15How do you implement row-level (resource-level) authorization to ensure users can only access their own records in NestJS?
16What is PKCE and when is it required in OAuth2 flows in NestJS?
17How do you implement an OAuth2 Authorization Server in NestJS?
18How do you implement session-based authentication in NestJS?
19How does the validate() method in a Passport strategy relate to the NestJS request lifecycle?
20How do you implement JWT authentication in NestJS with access and refresh tokens?
21What should and should not go inside a JWT payload?
22How do you implement JWT token revocation (blacklisting) without a database lookup on every request in NestJS?
23What is the difference between AuthGuard('jwt') from Passport and writing a custom JwtAuthGuard in NestJS?
24How do you secure session cookies against common attacks (CSRF, XSS, session fixation) in NestJS?
25How do you implement brute force protection on the login endpoint in NestJS?
NestJSNestJS
Basics
Modules
Decorators
Controllers
Dependency Injection
Providers
Architecture
Request Lifecycle
Middleware
Guards
Interceptors
Pipes
Filters
Exception Handling
API Design
GraphQL
Database and ORM
Microservices
Authentication and Authorization
17 / 25

How do you implement an OAuth2 Authorization Server in NestJS?

Difficulty: 8/10
OAuth2 flows, NestJS guards & strategies, Token storage & revocation

Use @nestjs/oauth2-server which wraps the oauth2-server library. Implement the OAuth2 model interface to provide data persistence for clients, tokens, and authorization codes. Register grants (authorization_code, client_credentials, refresh_token) in the module configuration.

OAuth2 module setup and model implementation
Authorization server implementation checklist:
  1. 1

    getClient() — validate client credentials and return the registered OAuth2 client.

  2. 2

    saveAuthorizationCode() / getAuthorizationCode() — persist and retrieve short-lived authorization codes.

  3. 3

    saveToken() / getAccessToken() — persist and retrieve access and refresh tokens.

  4. 4

    verifyScope() — confirm the requested scopes are included in the granted token scopes.

  5. 5

    Always hash client secrets before storing — treat them like passwords.

Scenario Questions

0-2 years experience

  1. 1Suppose you need to add a simple password‑grant OAuth2 endpoint to an existing NestJS API. Walk me through the files you’d create and how you’d wire them together.
  2. 2If a client sends a request to your /token endpoint with an invalid client_secret, what response should your NestJS controller return and why?

2-5 years experience

  1. 1You’ve added the Authorization Code flow, but after deploying you notice that the redirect_uri parameter is being ignored and users are sent to a default page. What could be causing this in your NestJS setup?
  2. 2Explain how you would store refresh tokens securely in NestJS and what changes you’d make if you needed to rotate them without breaking existing sessions.
  3. 3During load testing the token endpoint becomes a bottleneck. Which parts of your NestJS implementation would you profile and how would you improve throughput?

5-8 years experience

  1. 1Design a multi‑tenant OAuth2 Authorization Server in NestJS that isolates client credentials per tenant while sharing the same codebase. What architectural changes are needed?
  2. 2How would you implement token revocation and introspection endpoints that scale to millions of active tokens, considering NestJS’s module system and database choices?
  3. 3If you need to support both JWT access tokens and opaque reference tokens, how would you structure your NestJS services to keep the validation logic clean and extensible?

8+ years experience

  1. 1Your organization wants to migrate from a custom NestJS OAuth2 server to an external OpenID Connect provider without downtime. Outline a migration strategy that minimizes impact on existing clients and internal services.
  2. 2Discuss the long‑term maintenance implications of embedding OAuth2 logic directly in NestJS versus delegating to a dedicated identity platform. What factors would drive a decision at the staff level?
  3. 3How would you set up cross‑team governance for scopes and claims in a NestJS‑based Authorization Server to ensure security and compliance across multiple product lines?

Follow-up Questions

  • What would you change if you had to support PKCE for public clients?
  • How do you ensure the refresh token endpoint is not vulnerable to replay attacks?
  • Can you describe how you’d test the end‑to‑end OAuth flow in this NestJS setup?
Share

Share via WhatsApp, X, Facebook, LinkedIn or copy link. Open Graph preview enabled.