JWT strategy in NestJS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the output when a valid JWT token is provided?

Consider a NestJS JWT strategy that validates a token and returns the user payload. What will be the result of the validate method if the token is valid and contains { userId: 42, username: 'alice' }?

NestJS

async validate(payload: any) {
  return { id: payload.userId, name: payload.username };
}

A Throws UnauthorizedException

B { userId: 42, username: 'alice' }

C { id: 42, name: 'alice' }

D Returns null

💡 Hint

The validate method transforms the JWT payload into a user object.

The validate method receives the decoded JWT payload and returns a user object with properties renamed as id and name. So the output matches the transformed object.

📝 Syntax

intermediate

Which option correctly imports and uses Passport JWT strategy in NestJS?

You want to create a JWT strategy in NestJS using Passport. Which import and class extension is correct?

A

import { JwtStrategy } from '@nestjs/passport';
export class JwtStrategy extends JwtStrategy {}

B

import { PassportStrategy } from '@nestjs/passport';
import { Strategy } from 'passport-jwt';
export class JwtStrategy extends PassportStrategy(Strategy) {}

C

import { Strategy } from 'passport-jwt';
export class JwtStrategy extends Strategy {}

D

import { PassportJwtStrategy } from 'passport';
export class JwtStrategy extends PassportJwtStrategy {}

💡 Hint

NestJS wraps Passport strategies with PassportStrategy class.

NestJS requires extending PassportStrategy with the specific Passport strategy passed as a parameter. The correct import is PassportStrategy from '@nestjs/passport' and Strategy from 'passport-jwt'.

🔧 Debug

advanced

Why does the JWT strategy always throw UnauthorizedException?

Given this JWT strategy code snippet, why does authentication always fail with UnauthorizedException? class JwtStrategy extends PassportStrategy(Strategy) { constructor() { super({ jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(), secretOrKey: 'secretKey', }); } async validate(payload) { return null; } }

A The constructor is missing a call to super() with options.

B The secret key is incorrect, causing token verification to fail.

C The jwtFromRequest function is not extracting the token properly.

D The validate method returns null, which Passport treats as failed validation.

💡 Hint

The validate method must return a user object or throw an exception.

Returning null from validate signals Passport that the user is not authenticated, causing UnauthorizedException. The method should return a valid user object.

🧠 Conceptual

advanced

What is the purpose of the secretOrKey option in JWT strategy?

In NestJS JWT strategy configuration, what does the secretOrKey option do?

A It specifies the secret used to verify the JWT signature.

B It defines the expiration time of the JWT token.

C It sets the algorithm used to sign the JWT token.

D It extracts the JWT token from the request headers.

💡 Hint

Think about how JWT tokens are verified.

The secretOrKey is the secret string or key used to verify the JWT token's signature to ensure it was issued by a trusted source.

❓ state_output

expert

What is the value of request.user after successful JWT authentication?

In a NestJS controller guarded by JwtAuthGuard, after a successful request with a valid JWT token, what will request.user contain?

A The object returned by the JWT strategy's validate method.

B An empty object {}.

C The raw JWT token string from the Authorization header.

D The decoded JWT payload without any transformation.

💡 Hint

The validate method controls what user data is attached to the request.

NestJS attaches to request.user whatever the validate method returns after verifying the JWT token.