Local strategy (username/password) in NestJS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when the local strategy validates a user with correct credentials?

Consider a NestJS local strategy that checks username and password. What is the output when a user provides the correct username and password?

NestJS

async validate(username: string, password: string) {
  const user = await this.authService.validateUser(username, password);
  if (!user) {
    throw new UnauthorizedException();
  }
  return user;
}

A Returns the user object to the caller for further processing

B Throws a ForbiddenException error

C Returns null without throwing an error

D Logs the user out immediately

💡 Hint

Think about what the validate method should do when credentials are correct.

The validate method returns the user object when credentials are correct so that the authentication flow can continue. It throws an error only if validation fails.

📝 Syntax

intermediate

Which option correctly implements the Passport local strategy constructor in NestJS?

Choose the correct constructor code snippet for a NestJS local strategy extending PassportStrategy(LocalStrategy).

NestJS

import { Strategy } from 'passport-local';
import { PassportStrategy } from '@nestjs/passport';

export class LocalStrategy extends PassportStrategy(Strategy) {
  constructor(private authService: AuthService) {
    super({ usernameField: 'email' });
  }

  async validate(username: string, password: string) {
    // validation logic
  }
}

A constructor(private authService: AuthService) { super({ usernameField: 'email' }); }

B constructor(authService: AuthService) { super({ usernameField: 'email' }); this.authService = authService; }

C constructor() { super({ usernameField: 'email' }); }

D constructor(private authService: AuthService) { super(); this.authService = authService; }

💡 Hint

Remember how to pass options to the PassportStrategy constructor and inject services.

Option A correctly uses dependency injection and passes the usernameField option to the super constructor.

🔧 Debug

advanced

Why does this local strategy fail to throw UnauthorizedException even with incorrect credentials?

Review the validate method below. Why does it fail to throw UnauthorizedException even when the username and password are incorrect? async validate(username: string, password: string) { const user = await this.authService.validateUser(username, password); if (user === null) { throw new UnauthorizedException(); } return user; }

NestJS

async validate(username: string, password: string) {
  const user = await this.authService.validateUser(username, password);
  if (user === null) {
    throw new UnauthorizedException();
  }
  return user;
}

A The validate method is missing an await keyword

B authService.validateUser returns undefined instead of null, so the condition fails

C UnauthorizedException is thrown before calling validateUser

D The method returns user before checking if it is null

💡 Hint

Check what value validateUser returns when credentials are invalid.

If validateUser returns undefined on failure, checking for null will not catch it, so the exception is never thrown correctly.

❓ state_output

advanced

What is the value of 'user' after validate returns successfully?

Given this local strategy validate method: async validate(username: string, password: string) { const user = await this.authService.validateUser(username, password); if (!user) { throw new UnauthorizedException(); } return user; } If validateUser returns { id: 5, username: 'alice' }, what is the value of user after validate returns?

NestJS

async validate(username: string, password: string) {
  const user = await this.authService.validateUser(username, password);
  if (!user) {
    throw new UnauthorizedException();
  }
  return user;
}

A Throws UnauthorizedException

B undefined

C null

D { id: 5, username: 'alice' }

💡 Hint

What does the method return if the user is valid?

The method returns the user object from validateUser if it exists, so user will be the object { id: 5, username: 'alice' }.

🧠 Conceptual

expert

Which option best explains why the local strategy uses 'usernameField' option?

In NestJS local strategy, why do we pass { usernameField: 'email' } to the PassportStrategy constructor?

A To rename the validate method parameter from username to email automatically

B To enforce that only email addresses can be used as usernames in the database

C To tell Passport to use the 'email' field from the request instead of the default 'username' field

D To enable Passport to hash the email field before validation

💡 Hint

Think about how Passport extracts credentials from the login form.

The usernameField option tells Passport which field name to look for in the login request. By default, it looks for 'username', but many apps use 'email' instead.