JWT strategy in NestJS - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of a JWT strategy in NestJS?

A JWT strategy in NestJS is used to authenticate users by verifying JSON Web Tokens sent with requests. It helps secure routes by checking if the token is valid and extracting user information from it.

beginner

Which NestJS package provides the tools to implement a JWT strategy?

The @nestjs/passport package along with passport-jwt is used to implement JWT strategies in NestJS. @nestjs/passport integrates Passport.js with NestJS, and passport-jwt handles JWT validation.

intermediate

In a JWT strategy, what is the role of the validate() method?

The validate() method checks the decoded JWT payload and returns user data if valid. This data is then attached to the request object, allowing access to user info in protected routes.

intermediate

How does the JWT strategy extract the token from incoming requests?

The JWT strategy uses an extractor function, commonly JwtFromRequest.ExtractJwt.fromAuthHeaderAsBearerToken(), which looks for the token in the Authorization header as a Bearer token.

beginner

Why is it important to keep the JWT secret key safe in a NestJS application?

The JWT secret key signs and verifies tokens. If exposed, attackers can create fake tokens and access protected resources. Keeping it safe ensures token integrity and application security.

What does the JWT strategy primarily verify in a request?

A The validity of the JSON Web Token

B The user's password

C The request's IP address

D The request's HTTP method

The JWT strategy checks if the JSON Web Token sent with the request is valid and not tampered with.

Which header usually contains the JWT in a request?

A User-Agent

B Content-Type

C Accept

D Authorization

The JWT is typically sent in the Authorization header as a Bearer token.

In NestJS, which method inside the JWT strategy returns user info after token validation?

A sign()

B authenticate()

C validate()

D decode()

The validate() method processes the decoded token payload and returns user information.

Which package is NOT required to implement JWT strategy in NestJS?

A @nestjs/passport

B express-session

C passport-jwt

D jsonwebtoken

express-session is not needed for JWT strategy, which is stateless and does not use sessions.

What happens if the JWT secret key is leaked?

A Attackers can forge tokens and access protected routes

B Tokens expire immediately

C Users get logged out automatically

D The application crashes

If the secret key is leaked, attackers can create fake tokens and bypass authentication.

Explain how a JWT strategy works in NestJS to protect routes.

Think about how the token is checked and how user info becomes available in your app.

Describe the steps to set up a JWT strategy in a NestJS application.

Focus on packages, class setup, and how validation is done.