How do you implement JWT refresh token rotation with secure storage in NestJS?

Q: How do you implement JWT refresh token rotation with secure storage in NestJS?

@Injectable() export class AuthService { async updateRefreshToken(userId: number, refreshToken: string): Promise { const hashed = await bcrypt.hash(refreshToken, 10); await this.usersService.update(userId, { hashedRefreshToken: hashed }); } async logout(userId: number): Promise { await this.usersService.update(userId, { hashedRefreshToken: null }); } } // Refresh endpoint — validates old token, issues new pair @Post('refresh') @UseGuards(AuthGuard('jwt-refresh')) async refresh(@CurrentUser() user: UserWithRefreshToken) { const tokens = await this.authService.login(user); await this.authService.updateRefreshToken(user.id, tokens.refreshToken); return tokens; } // JwtRefreshStrategy — reads and verifies the refresh token @Injectable() export class JwtRefreshStrategy extends PassportStrategy(Strategy, 'jwt-refresh') { constructor(config: ConfigService, private authService: AuthService) { super({ jwtFromRequest: ExtractJwt.fromBodyField('refreshToken'), secretOrKey: config.get('JWT_REFRESH_SECRET'), passReqToCallback: true, }); } async validate(req: Request, payload: JwtPayload) { const refreshToken = req.body.refreshToken; return this.authService.verifyRefreshToken(payload.sub, refreshToken); } } Rotation invalidates the old refresh token on every use — only the latest token is valid. Detected reuse of a rotated token is a signal of theft — revoke all sessions for that user immediately. Never store refresh tokens in plain text — always hash with bcrypt before persisting. Set hashedRefreshToken to null on logout so the token cannot be used after the user signs out. passReqToCallback: true allows the strategy's validate() to access the raw refresh token from the request body.

Difficulty: 7/10

JWT, refresh token rotation, NestJS security

Hash the refresh token with bcrypt before storing in the database. On each refresh, verify the incoming token against the hash, issue a new token pair, invalidate the old refresh token, and store the new hash. Reuse of a rotated token should trigger a full logout of all sessions as a theft signal.

Refresh token rotation with hashed storage

Refresh token rotation security rules:

1
Rotation invalidates the old refresh token on every use — only the latest token is valid.

How do you implement JWT refresh token rotation with secure storage in NestJS?

Difficulty: 7/10

JWT, refresh token rotation, NestJS security

Hash the refresh token with bcrypt before storing in the database. On each refresh, verify the incoming token against the hash, issue a new token pair, invalidate the old refresh token, and store the new hash. Reuse of a rotated token should trigger a full logout of all sessions as a theft signal.

Refresh token rotation with hashed storage

Refresh token rotation security rules:

1
Rotation invalidates the old refresh token on every use — only the latest token is valid.

How do you implement JWT refresh token rotation with secure storage in NestJS?

Hash the refresh token with bcrypt before storing in the database. On each refresh, verify the incoming token against the hash, issue a new token pair, invalidate the old refresh token, and store the new hash. Reuse of a rotated token should trigger a full logout of all sessions as a theft signal.

How do you implement JWT refresh token rotation with secure storage in NestJS?

Hash the refresh token with bcrypt before storing in the database. On each refresh, verify the incoming token against the hash, issue a new token pair, invalidate the old refresh token, and store the new hash. Reuse of a rotated token should trigger a full logout of all sessions as a theft signal.

Scenario Questions

Follow-up Questions