Questions
5 of 25
1How do you implement a local (username/password) Passport strategy in NestJS?
2How do you register a global JWT guard so all routes are protected by default in NestJS?
3What is RBAC and how do you implement a basic roles guard in NestJS?
4What is the difference between RBAC and ABAC and when would you use each in NestJS?
5How does the OAuth2 authorization code flow work and how do you implement it with Passport in NestJS?
6How do you implement API key authentication as an alternative to JWT in NestJS?
7How do you implement multi-tenant authentication where each tenant has its own JWT secret in NestJS?
8How do you implement JWT refresh token rotation with secure storage in NestJS?
9How do you implement ABAC with CASL in a NestJS application?
10What is the difference between JWT and session-based authentication and when do you choose each in NestJS?
11How do you implement two-factor authentication (2FA) with TOTP in NestJS?
12How do you implement permission-based authorization at the field level in a GraphQL resolver in NestJS?
13How do you test authentication guards and strategies in NestJS?
14What is Passport.js and how does it integrate with NestJS?
15How do you implement row-level (resource-level) authorization to ensure users can only access their own records in NestJS?
16What is PKCE and when is it required in OAuth2 flows in NestJS?
17How do you implement an OAuth2 Authorization Server in NestJS?
18How do you implement session-based authentication in NestJS?
19How does the validate() method in a Passport strategy relate to the NestJS request lifecycle?
20How do you implement JWT authentication in NestJS with access and refresh tokens?
21What should and should not go inside a JWT payload?
22How do you implement JWT token revocation (blacklisting) without a database lookup on every request in NestJS?
23What is the difference between AuthGuard('jwt') from Passport and writing a custom JwtAuthGuard in NestJS?
24How do you secure session cookies against common attacks (CSRF, XSS, session fixation) in NestJS?
25How do you implement brute force protection on the login endpoint in NestJS?
NestJSNestJS
Basics
Modules
Decorators
Controllers
Dependency Injection
Providers
Architecture
Request Lifecycle
Middleware
Guards
Interceptors
Pipes
Filters
Exception Handling
API Design
GraphQL
Database and ORM
Microservices
Authentication and Authorization
05 / 25

How does the OAuth2 authorization code flow work and how do you implement it with Passport in NestJS?

Difficulty: 6/10
OAuth2 Authorization Code Flow, Passport integration, NestJS authentication

The authorization code flow redirects the user to the provider's consent screen, receives an authorization code at the callback URL, and exchanges it for tokens. In NestJS, the GET /auth/google route triggers the redirect via AuthGuard('google'). The callback route handles the code exchange and calls validate() with the user profile.

Google OAuth2 strategy and controller
OAuth2 authorization code flow steps:
  1. 1
    1. GET /auth/google — AuthGuard redirects the browser to Google's authorization endpoint.
  2. 2
    1. User consents on Google's screen.
  3. 3
    1. Google redirects to callbackURL with an authorization code.
  4. 4
    1. AuthGuard('google') on the callback route exchanges the code for tokens automatically.
  5. 5
    1. validate() is called with the access token and user profile — find or create the user in your database.
  6. 6
    1. Redirect the browser to the frontend with a JWT so subsequent API calls use JWT instead of sessions.

Scenario Questions

0-2 years experience

  1. 1We need to add Google login to a NestJS app using Passport. Walk me through the steps you'd take to set up the OAuth2 authorization code flow.
  2. 2If the user is redirected back to our callback URL but the `code` query parameter is missing, what would happen and how would you handle it?

2-5 years experience

  1. 1During integration you notice that after a successful login the user is not persisted in the session. What could cause this in the NestJS Passport setup?
  2. 2You receive a 401 error when exchanging the authorization code for an access token. Describe how you would debug the issue.

5-8 years experience

  1. 1Our service must support Google and GitHub logins while sharing a common session store. How would you structure the NestJS modules and Passport strategies to keep the code DRY and maintainable?
  2. 2At peak traffic the token‑exchange step becomes a bottleneck. What architectural changes could you make to improve throughput and reliability?

8+ years experience

  1. 1We are moving from a monolith to microservices but still need a unified OAuth2 login experience across services. How would you redesign the authentication flow and what role would Passport play?
  2. 2The organization wants dynamic, per‑application scope negotiation and strict auditability. How would you extend the NestJS/Passport implementation to support this while keeping security reviews manageable?

Follow-up Questions

  • What security concerns would you watch out for in this flow?
  • How would you test the OAuth integration end‑to‑end?
  • Can you explain how you’d refresh an expired access token?
Share

Share via WhatsApp, X, Facebook, LinkedIn or copy link. Open Graph preview enabled.