How do you implement session-based authentication in NestJS?

Q: How do you implement session-based authentication in NestJS?

// npm i express-session connect-redis ioredis @types/express-session // main.ts const app = await NestFactory.create(AppModule); app.use( session({ secret: process.env.SESSION_SECRET, resave: false, saveUninitialized: false, store: new RedisStore({ client: redisClient }), cookie: { httpOnly: true, secure: process.env.NODE_ENV === 'production', maxAge: 7 * 24 * 60 * 60 * 1000, // 7 days sameSite: 'strict', }, }), ); app.use(passport.initialize()); app.use(passport.session()); // Serialize — store user ID in session passport.serializeUser((user: User, done) => done(null, user.id)); // Deserialize — load user from DB on each request passport.deserializeUser(async (id: number, done) => { try { done(null, await usersService.findOne(id)); } catch (e) { done(e); } }); // Login — Passport creates the session automatically @Post('login') @UseGuards(AuthGuard('local')) login(@Request() req) { return { message: 'Logged in', user: req.user }; } // Logout — destroy session and clear cookie @Post('logout') logout(@Request() req, @Res() res: Response) { req.logout(err => { if (err) throw new InternalServerErrorException(); res.clearCookie('connect.sid'); res.json({ message: 'Logged out' }); }); } Order matters: session() middleware must run before passport.initialize() and passport.session(). resave: false — do not save the session if it was not modified; prevents unnecessary writes. saveUninitialized: false — do not save empty sessions; required for GDPR compliance. Use Redis store in production — in-memory store is not shared across multiple instances. serializeUser stores the minimum identifier (user ID); deserializeUser loads the full user on each request.

Difficulty: 5/10

session management, Passport integration, distributed session store

Install express-session and connect it as middleware in main.ts before initializing Passport. Configure passport.session() to enable session serialization. Implement serializeUser and deserializeUser to store and load the user from the session. Use a Redis store for distributed deployments.

Session middleware setup, serialize/deserialize, and logout

Session authentication setup rules:

1
Order matters: session() middleware must run before passport.initialize() and passport.session().

How do you implement session-based authentication in NestJS?

Difficulty: 5/10

session management, Passport integration, distributed session store

Install express-session and connect it as middleware in main.ts before initializing Passport. Configure passport.session() to enable session serialization. Implement serializeUser and deserializeUser to store and load the user from the session. Use a Redis store for distributed deployments.

Session middleware setup, serialize/deserialize, and logout

Session authentication setup rules:

1
Order matters: session() middleware must run before passport.initialize() and passport.session().

How do you implement session-based authentication in NestJS?

Install express-session and connect it as middleware in main.ts before initializing Passport. Configure passport.session() to enable session serialization. Implement serializeUser and deserializeUser to store and load the user from the session. Use a Redis store for distributed deployments.

How do you implement session-based authentication in NestJS?

Install express-session and connect it as middleware in main.ts before initializing Passport. Configure passport.session() to enable session serialization. Implement serializeUser and deserializeUser to store and load the user from the session. Use a Redis store for distributed deployments.

Scenario Questions

Follow-up Questions