Passport.js integration in NestJS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the output of this NestJS Passport.js local strategy validation?

Given the following local strategy validate method, what will be the result when a user with username 'john' and password 'pass123' is validated?

NestJS

async validate(username: string, password: string): Promise<any> {
  if (username === 'john' && password === 'pass123') {
    return { userId: 1, username: 'john' };
  }
  return null;
}

A Returns { userId: 1, username: 'john' }

B Returns null

C Throws an error

D Returns undefined

💡 Hint

Think about what the method returns when username and password match.

The validate method returns a user object when credentials match, otherwise null. Here, username and password match, so it returns the user object.

❓ state_output

intermediate

What is the value of req.user after successful JWT authentication?

In a NestJS controller protected by Passport JWT strategy, what will be the value of req.user if the JWT token is valid and contains { sub: 42, username: 'alice' }?

NestJS

import { Controller, Get, Req, UseGuards } from '@nestjs/common';
import { AuthGuard } from '@nestjs/passport';

@Controller('profile')
export class ProfileController {
  @UseGuards(AuthGuard('jwt'))
  @Get()
  getProfile(@Req() req) {
    return req.user;
  }
}

A { sub: 42, username: 'alice' }

B undefined

C null

D Throws an UnauthorizedException

💡 Hint

What does Passport attach to req after successful JWT validation?

Passport attaches the decoded JWT payload to req.user after successful authentication.

📝 Syntax

advanced

Which option correctly implements a Passport local strategy in NestJS?

Choose the correct implementation of a Passport local strategy validate method in NestJS that returns a user object if username is 'admin' and password is 'secret'.

A

async validate(username: string, password: string) {
  if (username === 'admin' && password === 'secret') {
    return { id: 1, username: 'admin' };
  }
  return null;
}

B

async validate(username: string, password: string): Promise<any> {
  if (username === 'admin' && password === 'secret') {
    return { id: 1, username: 'admin' };
  }
  throw new UnauthorizedException();
}

C

async validate(username: string, password: string): Promise<void> {
  if (username === 'admin' && password === 'secret') {
    return { id: 1, username: 'admin' };
  }
}

D

validate(username, password) {
  if (username === 'admin' && password === 'secret') {
    return { id: 1, username: 'admin' };
  }
  return null;
}

💡 Hint

The validate method should throw an exception if credentials are invalid.

In NestJS Passport strategies, the validate method should throw UnauthorizedException on failure, not return null.

🔧 Debug

advanced

Why does this Passport JWT strategy fail to authenticate?

Given this JWT strategy validate method, why does authentication always fail? async validate(payload: any) { if (payload.sub) { return { userId: payload.sub }; } return null; }

A The method should return payload directly, not a new object.

B The validate method must be synchronous, async causes failure.

C Returning null instead of throwing UnauthorizedException causes failure.

D The payload.sub property is undefined, so it always returns null.

💡 Hint

Check what happens when validate returns null in NestJS Passport.

Returning null from validate causes Passport to reject authentication silently. It should throw UnauthorizedException instead.

🧠 Conceptual

expert

What is the main purpose of Passport.js in NestJS applications?

Choose the best description of Passport.js role in NestJS apps.

A To replace NestJS guards with a simpler authorization system.

B To handle database connections and ORM integration automatically.

C To serve static files and manage HTTP routing.

D To provide a modular and flexible authentication middleware supporting many strategies.

💡 Hint

Think about what Passport.js is known for in Node.js apps.

Passport.js is a middleware for authentication supporting many strategies, not for database or routing.

Practice

1. What is the main purpose of integrating Passport.js in a NestJS application?

easy

A. To handle user authentication and login strategies

B. To manage database connections

C. To style the frontend components

D. To optimize server performance

Solution

1. Step 1: Understand Passport.js role

   Passport.js is a library designed to handle user authentication in Node.js applications.

2. Step 2: Connect Passport.js with NestJS

   In NestJS, Passport.js is used to define login strategies and verify users securely.

3. Final Answer:

   To handle user authentication and login strategies -> Option A

4. Quick Check:

   Passport.js = Authentication [OK]

Hint: Passport.js is for login and user verification [OK]

Common Mistakes:

• Confusing Passport.js with database tools
• Thinking Passport.js styles UI
• Assuming Passport.js improves server speed

2. Which of the following is the correct way to apply a Passport.js local strategy in a NestJS controller?

easy

A. @UseGuards('local')

B. @UseGuards(LocalStrategy)

C. @UseGuards(AuthGuard('local'))

D. @UseGuards(PassportLocal)

Solution

1. Step 1: Recall NestJS guard syntax

   Passport strategies are applied using AuthGuard with the strategy name as a string.

2. Step 2: Match correct syntax

   The correct syntax is @UseGuards(AuthGuard('local')) to apply the local strategy guard.

3. Final Answer:

   @UseGuards(AuthGuard('local')) -> Option C

4. Quick Check:

   UseGuards with AuthGuard('strategy') [OK]

Hint: Use AuthGuard with strategy name string [OK]

Common Mistakes:

• Passing strategy class instead of string
• Omitting AuthGuard wrapper
• Using incorrect decorator syntax

3. Given this NestJS Passport.js setup, what will be the output when a user with correct credentials logs in?

async validate(username: string, password: string) {
  if (username === 'user' && password === 'pass') {
    return { userId: 1, username };
  }
  return null;
}

medium

A. Returns undefined

B. Throws an error

C. Returns null always

D. Returns user object { userId: 1, username: 'user' }

Solution

1. Step 1: Analyze validate method logic

   The method checks if username is 'user' and password is 'pass'. If yes, it returns a user object.

2. Step 2: Determine output for correct credentials

   For correct credentials, it returns { userId: 1, username } which is { userId: 1, username: 'user' }.

3. Final Answer:

   Returns user object { userId: 1, username: 'user' } -> Option D

4. Quick Check:

   Correct credentials return user object [OK]

Hint: Correct credentials return user object, else null [OK]

Common Mistakes:

• Assuming it throws error on failure
• Confusing null with undefined
• Ignoring the return statement

4. Identify the error in this NestJS Passport.js guard usage:

@UseGuards(AuthGuard(LocalStrategy))
@Get('profile')
getProfile() {
  return 'User Profile';
}

medium

A. AuthGuard should receive strategy name as string, not class

B. Missing @Controller decorator

C. getProfile method must be async

D. AuthGuard cannot be used with @Get

Solution

1. Step 1: Check AuthGuard parameter

   AuthGuard expects a string with the strategy name, e.g., 'local', not the strategy class.

2. Step 2: Confirm correct usage

   Correct usage is @UseGuards(AuthGuard('local')), passing the strategy name as a string.

3. Final Answer:

   AuthGuard should receive strategy name as string, not class -> Option A

4. Quick Check:

   AuthGuard('strategyName') not class [OK]

Hint: Pass strategy name string to AuthGuard [OK]

Common Mistakes:

• Passing strategy class instead of string
• Forgetting to import AuthGuard
• Assuming method must be async

5. You want to protect a NestJS route so only logged-in users can access it using Passport.js. Which combination correctly sets this up?

1. Create a JWT strategy class
2. Use @UseGuards(AuthGuard('jwt')) on the route
3. Implement validate() method in strategy
4. Call AuthGuard('local') on the route

Which steps should you follow?

hard

A. All steps 1, 2, 3, and 4

B. Steps 1, 2, and 3 only

C. Steps 1 and 4 only

D. Steps 2 and 4 only

Solution

1. Step 1: Understand JWT strategy usage

   To protect routes with JWT, create a JWT strategy and implement validate() to verify tokens.

2. Step 2: Apply AuthGuard with 'jwt'

   Use @UseGuards(AuthGuard('jwt')) on routes to enforce JWT authentication.

3. Step 3: Exclude local strategy for JWT protection

   Using AuthGuard('local') is for login, not for protecting routes after login.

4. Final Answer:

   Steps 1, 2, and 3 only -> Option B

5. Quick Check:

   JWT strategy + AuthGuard('jwt') + validate() [OK]

Hint: Use JWT strategy and AuthGuard('jwt') to protect routes [OK]

Common Mistakes:

• Using local strategy guard to protect routes
• Skipping validate() method in strategy
• Applying AuthGuard without strategy name