Passport.js integration in NestJS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the output of this NestJS Passport.js local strategy validation?

Given the following local strategy validate method, what will be the result when a user with username 'john' and password 'pass123' is validated?

NestJS

async validate(username: string, password: string): Promise<any> {
  if (username === 'john' && password === 'pass123') {
    return { userId: 1, username: 'john' };
  }
  return null;
}

A Returns { userId: 1, username: 'john' }

B Returns null

C Throws an error

D Returns undefined

💡 Hint

Think about what the method returns when username and password match.

The validate method returns a user object when credentials match, otherwise null. Here, username and password match, so it returns the user object.

❓ state_output

intermediate

What is the value of req.user after successful JWT authentication?

In a NestJS controller protected by Passport JWT strategy, what will be the value of req.user if the JWT token is valid and contains { sub: 42, username: 'alice' }?

NestJS

import { Controller, Get, Req, UseGuards } from '@nestjs/common';
import { AuthGuard } from '@nestjs/passport';

@Controller('profile')
export class ProfileController {
  @UseGuards(AuthGuard('jwt'))
  @Get()
  getProfile(@Req() req) {
    return req.user;
  }
}

A { sub: 42, username: 'alice' }

B undefined

C null

D Throws an UnauthorizedException

💡 Hint

What does Passport attach to req after successful JWT validation?

Passport attaches the decoded JWT payload to req.user after successful authentication.

📝 Syntax

advanced

Which option correctly implements a Passport local strategy in NestJS?

Choose the correct implementation of a Passport local strategy validate method in NestJS that returns a user object if username is 'admin' and password is 'secret'.

A

async validate(username: string, password: string) {
  if (username === 'admin' && password === 'secret') {
    return { id: 1, username: 'admin' };
  }
  return null;
}

B

async validate(username: string, password: string): Promise<any> {
  if (username === 'admin' && password === 'secret') {
    return { id: 1, username: 'admin' };
  }
  throw new UnauthorizedException();
}

C

async validate(username: string, password: string): Promise<void> {
  if (username === 'admin' && password === 'secret') {
    return { id: 1, username: 'admin' };
  }
}

D

validate(username, password) {
  if (username === 'admin' && password === 'secret') {
    return { id: 1, username: 'admin' };
  }
  return null;
}

💡 Hint

The validate method should throw an exception if credentials are invalid.

In NestJS Passport strategies, the validate method should throw UnauthorizedException on failure, not return null.

🔧 Debug

advanced

Why does this Passport JWT strategy fail to authenticate?

Given this JWT strategy validate method, why does authentication always fail? async validate(payload: any) { if (payload.sub) { return { userId: payload.sub }; } return null; }

A The method should return payload directly, not a new object.

B The validate method must be synchronous, async causes failure.

C Returning null instead of throwing UnauthorizedException causes failure.

D The payload.sub property is undefined, so it always returns null.

💡 Hint

Check what happens when validate returns null in NestJS Passport.

Returning null from validate causes Passport to reject authentication silently. It should throw UnauthorizedException instead.

🧠 Conceptual

expert

What is the main purpose of Passport.js in NestJS applications?

Choose the best description of Passport.js role in NestJS apps.

A To replace NestJS guards with a simpler authorization system.

B To handle database connections and ORM integration automatically.

C To serve static files and manage HTTP routing.

D To provide a modular and flexible authentication middleware supporting many strategies.

💡 Hint

Think about what Passport.js is known for in Node.js apps.

Passport.js is a middleware for authentication supporting many strategies, not for database or routing.