How does the OAuth2 authorization code flow work and how do you implement it with Passport in NestJS?

Q: How does the OAuth2 authorization code flow work and how do you implement it with Passport in NestJS?

// npm i passport-google-oauth20 @types/passport-google-oauth20 @Injectable() export class GoogleStrategy extends PassportStrategy(Strategy, 'google') { constructor(config: ConfigService, private authService: AuthService) { super({ clientID: config.get('GOOGLE_CLIENT_ID'), clientSecret: config.get('GOOGLE_CLIENT_SECRET'), callbackURL: config.get('GOOGLE_CALLBACK_URL'), scope: ['email', 'profile'], }); } async validate( accessToken: string, refreshToken: string, profile: Profile, ): Promise { const { emails, displayName, photos } = profile; return this.authService.findOrCreateOAuthUser({ email: emails[0].value, name: displayName, avatar: photos[0]?.value, provider: 'google', providerId: profile.id, }); } } @Controller('auth') export class AuthController { @Get('google') @UseGuards(AuthGuard('google')) // redirects to Google consent screen googleLogin() {} @Get('google/callback') @UseGuards(AuthGuard('google')) // Google calls back here with code async googleCallback(@Request() req, @Res() res: Response) { const tokens = await this.authService.login(req.user); res.redirect(`${process.env.FRONTEND_URL}/auth/callback?token=${tokens.accessToken}`); } } 1. GET /auth/google — AuthGuard redirects the browser to Google's authorization endpoint. 2. User consents on Google's screen. 3. Google redirects to callbackURL with an authorization code. 4. AuthGuard('google') on the callback route exchanges the code for tokens automatically. 5. validate() is called with the access token and user profile — find or create the user in your database. 6. Redirect the browser to the frontend with a JWT so subsequent API calls use JWT instead of sessions.

Difficulty: 6/10

OAuth2 Authorization Code Flow, Passport integration, NestJS authentication

The authorization code flow redirects the user to the provider's consent screen, receives an authorization code at the callback URL, and exchanges it for tokens. In NestJS, the GET /auth/google route triggers the redirect via AuthGuard('google'). The callback route handles the code exchange and calls validate() with the user profile.

Google OAuth2 strategy and controller

OAuth2 authorization code flow steps:

1
1. GET /auth/google — AuthGuard redirects the browser to Google's authorization endpoint.

How does the OAuth2 authorization code flow work and how do you implement it with Passport in NestJS?

Difficulty: 6/10

OAuth2 Authorization Code Flow, Passport integration, NestJS authentication

The authorization code flow redirects the user to the provider's consent screen, receives an authorization code at the callback URL, and exchanges it for tokens. In NestJS, the GET /auth/google route triggers the redirect via AuthGuard('google'). The callback route handles the code exchange and calls validate() with the user profile.

Google OAuth2 strategy and controller

OAuth2 authorization code flow steps:

1
1. GET /auth/google — AuthGuard redirects the browser to Google's authorization endpoint.

How does the OAuth2 authorization code flow work and how do you implement it with Passport in NestJS?

How does the OAuth2 authorization code flow work and how do you implement it with Passport in NestJS?

Scenario Questions

Follow-up Questions