JWT authentication guard in NestJS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when a valid JWT is provided to the guard?

Consider a NestJS JWT authentication guard that validates the token and attaches the user to the request. What is the expected behavior when a valid JWT is sent in the Authorization header?

NestJS

import { Injectable, CanActivate, ExecutionContext } from '@nestjs/common';
import { JwtService } from '@nestjs/jwt';

@Injectable()
export class JwtAuthGuard implements CanActivate {
  constructor(private jwtService: JwtService) {}

  canActivate(context: ExecutionContext): boolean {
    const request = context.switchToHttp().getRequest();
    const authHeader = request.headers['authorization'];
    if (!authHeader) return false;
    const token = authHeader.split(' ')[1];
    try {
      const payload = this.jwtService.verify(token);
      request.user = payload;
      return true;
    } catch {
      return false;
    }
  }
}

A The guard returns true but does not modify the request object.

B The guard returns false and throws an exception.

C The guard ignores the token and always returns true.

D The guard returns true and attaches the decoded user payload to request.user.

💡 Hint

Think about what the guard does after verifying the token.

When the JWT is valid, the guard verifies it and attaches the decoded payload to request.user. Then it returns true to allow the request to proceed.

📝 Syntax

intermediate

Which option correctly extracts the JWT from the Authorization header?

In a NestJS guard, you want to extract the JWT token from the Authorization header which looks like 'Bearer <token>'. Which code snippet correctly extracts the token?

A const token = request.headers['authorization'].replace('Bearer ', '');

B const token = request.headers['authorization'].split(' ')[1];

C const token = request.headers['authorization'].slice(7);

D const token = request.headers['authorization'].substring(7);

💡 Hint

Remember the 'Bearer ' prefix is 7 characters including the space.

Splitting the header string by space and taking the second part correctly extracts the token. Other methods may have off-by-one errors.

🔧 Debug

advanced

Why does this JWT guard always reject requests?

Given the following guard code, why does it always return false even with a valid token?

NestJS

import { Injectable, CanActivate, ExecutionContext } from '@nestjs/common';
import { JwtService } from '@nestjs/jwt';

@Injectable()
export class JwtAuthGuard implements CanActivate {
  constructor(private jwtService: JwtService) {}

  canActivate(context: ExecutionContext): boolean {
    const request = context.switchToHttp().getRequest();
    const authHeader = request.headers['authorization'];
    if (!authHeader) return false;
    const token = authHeader.split(' ')[1];
    try {
      this.jwtService.verify(token);
      return false;
    } catch {
      return false;
    }
  }
}

A The guard returns false after verifying the token instead of true.

B The token extraction is incorrect causing verify to fail.

C The JwtService is not injected properly causing an error.

D The guard does not check for the Authorization header.

💡 Hint

Look at what the guard returns after successful verification.

The guard calls verify but then returns false regardless, so it never allows requests through.

❓ state_output

advanced

What is the value of request.user after a valid JWT is verified?

Assuming the JWT payload is {"sub": "123", "username": "alice"}, what will request.user contain after the guard runs successfully?

NestJS

const payload = { sub: '123', username: 'alice' };
request.user = payload;

A {"sub": "123", "username": "alice"}

B {"userId": "123", "name": "alice"}

C null

D undefined

💡 Hint

The guard sets request.user to the decoded token payload.

The guard assigns the decoded JWT payload directly to request.user, so it matches the payload exactly.

🧠 Conceptual

expert

What error occurs if the JWT token is missing in the Authorization header?

In a NestJS JWT guard, if the Authorization header is missing or does not contain a token, what error or behavior should you expect?

NestJS

canActivate(context: ExecutionContext): boolean {
  const request = context.switchToHttp().getRequest();
  const authHeader = request.headers['authorization'];
  if (!authHeader) return false;
  const token = authHeader.split(' ')[1];
  try {
    this.jwtService.verify(token);
    return true;
  } catch {
    return false;
  }
}

A The guard throws a JwtMalformedError from the JwtService.

B The guard throws a SyntaxError due to missing token.

C The guard returns false and the request is denied without throwing an error.

D The guard returns true and allows the request.

💡 Hint

Check the guard's behavior when the header is missing.

The guard checks if the header exists and returns false immediately if missing, denying access without throwing.