How does the validate() method in a Passport strategy relate to the NestJS request lifecycle?

Q: How does the validate() method in a Passport strategy relate to the NestJS request lifecycle?

// The flow for AuthGuard('local'): // 1. AuthGuard invokes the LocalStrategy // 2. LocalStrategy extracts email/password from request body // 3. validate(email, password) is called // 4a. Returns User -> req.user = User, canActivate() returns true // 4b. Throws error -> canActivate() returns false -> 401 // 4c. Returns null -> UnauthorizedException thrown // validate() return value accessible via @Request() @Post('login') @UseGuards(AuthGuard('local')) login(@Request() req) { return this.authService.signTokens(req.user); // req.user = validate() return } // Or use a custom @CurrentUser() param decorator export const CurrentUser = createParamDecorator( (_data, ctx: ExecutionContext) => ctx.switchToHttp().getRequest().user, ); @Post('login') @UseGuards(AuthGuard('local')) login(@CurrentUser() user: User) { return this.authService.signTokens(user); } validate() is the only method you implement — Passport handles credential extraction and req.user assignment. Returning a truthy value from validate() causes Passport to call req.logIn() and attach it to req.user. Returning null or false causes Passport to call UnauthorizedException via handleRequest(). Throwing an exception from validate() propagates to the exception filter as usual. The value returned by validate() is typed as request.user — use @CurrentUser() for clean injection.

Difficulty: 5/10

Passport strategy, NestJS request lifecycle, guards

validate() is called by Passport after it extracts credentials from the request. If it returns a value, Passport attaches it to request.user and canActivate() returns true. If it throws or returns null/false, the guard rejects the request with a 401. The return value is exactly what the handler receives via @Request() or a @CurrentUser() decorator.

validate() return value flow and @CurrentUser() decorator

validate() lifecycle rules:

1
validate() is the only method you implement — Passport handles credential extraction and req.user assignment.
2

How does the validate() method in a Passport strategy relate to the NestJS request lifecycle?

Difficulty: 5/10

Passport strategy, NestJS request lifecycle, guards

validate() is called by Passport after it extracts credentials from the request. If it returns a value, Passport attaches it to request.user and canActivate() returns true. If it throws or returns null/false, the guard rejects the request with a 401. The return value is exactly what the handler receives via @Request() or a @CurrentUser() decorator.

validate() return value flow and @CurrentUser() decorator

validate() lifecycle rules:

1
validate() is the only method you implement — Passport handles credential extraction and req.user assignment.
2

How does the validate() method in a Passport strategy relate to the NestJS request lifecycle?

How does the validate() method in a Passport strategy relate to the NestJS request lifecycle?

Scenario Questions

Follow-up Questions