JWT authentication guard in NestJS - Step-by-Step Execution

Concept Flow - JWT authentication guard

Request comes in

↓

Guard intercepts request

↓

Extract JWT from header

↓

Verify JWT validity

↓

Allow access

↓

Controller handles request

The guard checks the request for a JWT token, verifies it, and either allows or denies access based on validity.

Execution Sample

NestJS

canActivate(context: ExecutionContext) {
  const request = context.switchToHttp().getRequest();
  const token = this.extractToken(request);
  return this.jwtService.verifyAsync(token).then(() => true).catch(() => false);
}

This code checks if the JWT token in the request is valid and returns true or false accordingly.

Execution Table

Step	Action	Input	Result	Next Step
1	Guard intercepts request	Incoming HTTP request	Request object extracted	Extract JWT token
2	Extract JWT token	Request headers	JWT token string or undefined	Verify JWT token
3	Verify JWT token	JWT token string or undefined	Token valid or invalid	Allow or deny access
4	Allow access	Token valid	Return true	Controller handles request
5	Deny access	Token invalid or missing	Return false	Request denied with 401

💡 Execution stops after returning true or false to allow or deny access.

Variable Tracker

Variable	Start	After Step 2	After Step 3	Final
request	undefined	HTTP request object	HTTP request object	HTTP request object
token	undefined	JWT token string or undefined	JWT token string or undefined	JWT token string or undefined
verificationResult	undefined	undefined	true or false	true or false

Key Moments - 3 Insights

What happens if the JWT token is missing from the request?

At Step 2 in the execution_table, if the token is undefined, the verification at Step 3 fails, leading to denial of access at Step 5.

Why does the guard return true or false instead of throwing an error?

The guard returns true or false to signal if access is allowed or denied. Returning false triggers NestJS to respond with 401 Unauthorized automatically, as shown in Step 5.

How does the guard extract the JWT token from the request?

At Step 2, the guard reads the Authorization header from the request and extracts the token part, usually after 'Bearer '. If missing, token is undefined.

Visual Quiz - 3 Questions

Look at the execution_table, what is the result at Step 3 if the token is invalid?

A Token invalid

B Token valid

C Token missing

D Token expired

💡 Hint

Check Step 3 'Result' column in the execution_table for invalid token cases.

At which step does the guard decide to deny access?

A Step 3

B Step 5

C Step 4

D Step 2

💡 Hint

Look at the 'Next Step' and 'Action' columns in the execution_table for denial.

If the token is missing, what will the verificationResult variable be after Step 3?

A true

B undefined

C false

D null

💡 Hint

Refer to variable_tracker for verificationResult after Step 3 when token is missing.

Concept Snapshot

JWT Authentication Guard in NestJS:
- Intercepts incoming requests
- Extracts JWT token from Authorization header
- Verifies token validity asynchronously
- Returns true to allow access, false to deny
- Denied access triggers 401 Unauthorized response

Full Transcript

A JWT authentication guard in NestJS works by intercepting incoming HTTP requests. It extracts the JWT token from the Authorization header. Then it verifies the token asynchronously using the JWT service. If the token is valid, the guard returns true, allowing the request to proceed to the controller. If the token is missing or invalid, the guard returns false, which causes NestJS to respond with a 401 Unauthorized error. This process ensures only authenticated users can access protected routes.