Local strategy (username/password) in NestJS - Step-by-Step Execution

Concept Flow - Local strategy (username/password)

User submits username & password

↓

LocalStrategy validate() called

↓

Check username & password in DB

↓

Return user object

↓

Passport attaches user to request

↓

Request proceeds to controller

User sends credentials, LocalStrategy checks them, returns user if valid, else rejects.

Execution Sample

NestJS

async validate(username: string, password: string) {
  const user = await this.authService.validateUser(username, password);
  if (!user) {
    throw new UnauthorizedException();
  }
  return user;
}

This function checks username and password, returns user if valid, else throws error.

Execution Table

Step	Action	Input	Check Result	Outcome
1	Call validate()	username='alice', password='secret'	N/A	Proceed to check user
2	Call authService.validateUser()	username='alice', password='secret'	User found and password matches	Returns user object
3	Check if user exists	user object	User exists	Return user
4	Attach user to request	user object	N/A	User attached, request proceeds
5	Call validate() with wrong password	username='alice', password='wrong'	User not found or password mismatch	Throw UnauthorizedException

💡 Execution stops when user is returned or UnauthorizedException is thrown.

Variable Tracker

Variable	Start	After Step 2	After Step 3	After Step 5
username	undefined	'alice'	'alice'	'alice'
password	undefined	'secret' or 'wrong'	'secret' or 'wrong'	'wrong'
user	undefined	{id:1, name:'alice'} or null	{id:1, name:'alice'} or null	null

Key Moments - 2 Insights

Why does validate() throw UnauthorizedException sometimes?

Because authService.validateUser() returned null, meaning username or password was wrong (see execution_table step 5).

What happens if validate() returns a user?

Passport attaches the user to the request object so controllers can access it (see execution_table step 4).

Visual Quiz - 3 Questions

Look at the execution table, what is the outcome at step 3 when user exists?

A Throw UnauthorizedException

B Return user object

C Call authService.validateUser() again

D Attach null to request

💡 Hint

Check the 'Outcome' column in execution_table row 3.

At which step does the UnauthorizedException get thrown?

A Step 2

B Step 3

C Step 5

D Step 4

💡 Hint

Look for 'Throw UnauthorizedException' in the 'Outcome' column.

If the password is correct, what variable changes after step 2?

A user becomes user object

B password becomes undefined

C username becomes null

D user becomes null

💡 Hint

Check variable_tracker for 'user' after step 2.

Concept Snapshot

Local strategy checks username and password.
validate() calls authService.validateUser().
If valid, returns user object.
If invalid, throws UnauthorizedException.
User attached to request for later use.

Full Transcript

In NestJS, the Local strategy uses a validate() method to check username and password. When a user submits credentials, validate() calls authService.validateUser() to verify them. If the user is found and password matches, validate() returns the user object. Passport then attaches this user to the request so controllers can access it. If credentials are wrong, validate() throws an UnauthorizedException, stopping the request. This flow ensures only valid users proceed.