Passport.js integration in NestJS - Step-by-Step Execution

Concept Flow - Passport.js integration

Start NestJS App

↓

Import Passport Module

↓

Define Strategy (e.g., JWT)

↓

Register Strategy with Passport

↓

Use @UseGuards(AuthGuard('jwt'))

↓

Request comes in

↓

Passport validates user

↓

Allow or deny access

↓

Response sent

This flow shows how NestJS integrates Passport.js by importing modules, defining strategies, guarding routes, and validating users on requests.

Execution Sample

NestJS

import { Injectable } from '@nestjs/common';
import { PassportStrategy } from '@nestjs/passport';
import { Strategy, ExtractJwt } from 'passport-jwt';

@Injectable()
export class JwtStrategy extends PassportStrategy(Strategy) {
  constructor() {
    super({
      jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
      secretOrKey: 'secretKey',
    });
  }

  async validate(payload: any) {
    return { userId: payload.sub, username: payload.username };
  }
}

This code defines a JWT strategy for Passport in NestJS that extracts the token from the header and validates the payload.

Execution Table

Step	Action	Input	Output	Notes
1	Start NestJS app	None	App running	NestJS app boots up
2	Import PassportModule	PassportModule	Passport integrated	Passport features available
3	Define JwtStrategy	JWT config	Strategy ready	Strategy knows how to extract and verify token
4	Register JwtStrategy	JwtStrategy class	Strategy registered	Passport uses this strategy
5	Apply @UseGuards(AuthGuard('jwt'))	Controller route	Route guarded	Only requests with valid JWT allowed
6	Incoming request with JWT	Request headers with token	Token extracted	JwtStrategy extracts token
7	JwtStrategy validate() called	JWT payload	User object returned	Payload verified and user info returned
8	Access granted to route	Validated user	Route handler runs	User can access protected resource
9	Response sent	Route output	HTTP response	Client receives data
10	Incoming request without JWT	Request headers missing token	No token found	Access denied
11	Access denied	No valid user	401 Unauthorized	Client blocked from route

💡 Execution stops when request is either authorized or denied based on JWT presence and validity.

Variable Tracker

Variable	Start	After Step 6	After Step 7	Final
jwtToken	undefined	Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...	Same	Used for validation
payload	undefined	undefined	{ sub: 1, username: 'user1' }	Extracted from token
user	undefined	undefined	{ userId: 1, username: 'user1' }	Returned by validate()

Key Moments - 3 Insights

Why does the validate() method return a user object?

Because Passport uses the returned user object to attach it to the request, allowing route handlers to access authenticated user info (see execution_table step 7).

What happens if the JWT token is missing or invalid?

The guard denies access and returns 401 Unauthorized, stopping the request before reaching the route handler (see execution_table steps 10 and 11).

How does Passport know which strategy to use for a route?

The @UseGuards decorator specifies the strategy name like 'jwt', linking the route to the registered JwtStrategy (see execution_table step 5).

Visual Quiz - 3 Questions

Look at the execution_table, what is the output at step 7 when validate() is called?

A 401 Unauthorized error

B User object with userId and username

C Raw JWT token string

D Undefined

💡 Hint

Check the 'Output' column in execution_table row for step 7.

At which step does the route become guarded by Passport's JWT strategy?

A Step 5

B Step 3

C Step 6

D Step 9

💡 Hint

Look for when @UseGuards(AuthGuard('jwt')) is applied in execution_table.

If the JWT token is missing in the request, what is the final response sent?

A Route handler output

B User object

C 401 Unauthorized

D Empty response

💡 Hint

See execution_table steps 10 and 11 for missing token scenario.

Concept Snapshot

Passport.js integration in NestJS:
- Import PassportModule and register strategies
- Define strategy classes (e.g., JwtStrategy) with validate()
- Use @UseGuards(AuthGuard('strategyName')) on routes
- Passport extracts token, validates user, attaches user to request
- Guards block unauthorized access automatically

Full Transcript

This visual execution trace shows how Passport.js integrates with NestJS. The app starts and imports PassportModule. A JwtStrategy is defined to extract and verify JWT tokens from request headers. This strategy is registered with Passport. Routes are protected using the @UseGuards decorator with AuthGuard('jwt'). When a request arrives, Passport extracts the token, calls validate() to verify the payload, and returns a user object. If valid, the route handler runs with user info attached. If the token is missing or invalid, Passport denies access and returns a 401 Unauthorized response. Variables like jwtToken, payload, and user change as the request flows through these steps. Key moments include understanding validate()'s role, what happens on missing tokens, and how guards link strategies to routes. The quiz tests understanding of these steps and outputs.

Practice

1. What is the main purpose of integrating Passport.js in a NestJS application?

easy

A. To handle user authentication and login strategies

B. To manage database connections

C. To style the frontend components

D. To optimize server performance

Solution

1. Step 1: Understand Passport.js role

   Passport.js is a library designed to handle user authentication in Node.js applications.

2. Step 2: Connect Passport.js with NestJS

   In NestJS, Passport.js is used to define login strategies and verify users securely.

3. Final Answer:

   To handle user authentication and login strategies -> Option A

4. Quick Check:

   Passport.js = Authentication [OK]

Hint: Passport.js is for login and user verification [OK]

Common Mistakes:

• Confusing Passport.js with database tools
• Thinking Passport.js styles UI
• Assuming Passport.js improves server speed

2. Which of the following is the correct way to apply a Passport.js local strategy in a NestJS controller?

easy

A. @UseGuards('local')

B. @UseGuards(LocalStrategy)

C. @UseGuards(AuthGuard('local'))

D. @UseGuards(PassportLocal)

Solution

1. Step 1: Recall NestJS guard syntax

   Passport strategies are applied using AuthGuard with the strategy name as a string.

2. Step 2: Match correct syntax

   The correct syntax is @UseGuards(AuthGuard('local')) to apply the local strategy guard.

3. Final Answer:

   @UseGuards(AuthGuard('local')) -> Option C

4. Quick Check:

   UseGuards with AuthGuard('strategy') [OK]

Hint: Use AuthGuard with strategy name string [OK]

Common Mistakes:

• Passing strategy class instead of string
• Omitting AuthGuard wrapper
• Using incorrect decorator syntax

3. Given this NestJS Passport.js setup, what will be the output when a user with correct credentials logs in?

async validate(username: string, password: string) {
  if (username === 'user' && password === 'pass') {
    return { userId: 1, username };
  }
  return null;
}

medium

A. Returns undefined

B. Throws an error

C. Returns null always

D. Returns user object { userId: 1, username: 'user' }

Solution

1. Step 1: Analyze validate method logic

   The method checks if username is 'user' and password is 'pass'. If yes, it returns a user object.

2. Step 2: Determine output for correct credentials

   For correct credentials, it returns { userId: 1, username } which is { userId: 1, username: 'user' }.

3. Final Answer:

   Returns user object { userId: 1, username: 'user' } -> Option D

4. Quick Check:

   Correct credentials return user object [OK]

Hint: Correct credentials return user object, else null [OK]

Common Mistakes:

• Assuming it throws error on failure
• Confusing null with undefined
• Ignoring the return statement

4. Identify the error in this NestJS Passport.js guard usage:

@UseGuards(AuthGuard(LocalStrategy))
@Get('profile')
getProfile() {
  return 'User Profile';
}

medium

A. AuthGuard should receive strategy name as string, not class

B. Missing @Controller decorator

C. getProfile method must be async

D. AuthGuard cannot be used with @Get

Solution

1. Step 1: Check AuthGuard parameter

   AuthGuard expects a string with the strategy name, e.g., 'local', not the strategy class.

2. Step 2: Confirm correct usage

   Correct usage is @UseGuards(AuthGuard('local')), passing the strategy name as a string.

3. Final Answer:

   AuthGuard should receive strategy name as string, not class -> Option A

4. Quick Check:

   AuthGuard('strategyName') not class [OK]

Hint: Pass strategy name string to AuthGuard [OK]

Common Mistakes:

• Passing strategy class instead of string
• Forgetting to import AuthGuard
• Assuming method must be async

5. You want to protect a NestJS route so only logged-in users can access it using Passport.js. Which combination correctly sets this up?

1. Create a JWT strategy class
2. Use @UseGuards(AuthGuard('jwt')) on the route
3. Implement validate() method in strategy
4. Call AuthGuard('local') on the route

Which steps should you follow?

hard

A. All steps 1, 2, 3, and 4

B. Steps 1, 2, and 3 only

C. Steps 1 and 4 only

D. Steps 2 and 4 only

Solution

1. Step 1: Understand JWT strategy usage

   To protect routes with JWT, create a JWT strategy and implement validate() to verify tokens.

2. Step 2: Apply AuthGuard with 'jwt'

   Use @UseGuards(AuthGuard('jwt')) on routes to enforce JWT authentication.

3. Step 3: Exclude local strategy for JWT protection

   Using AuthGuard('local') is for login, not for protecting routes after login.

4. Final Answer:

   Steps 1, 2, and 3 only -> Option B

5. Quick Check:

   JWT strategy + AuthGuard('jwt') + validate() [OK]

Hint: Use JWT strategy and AuthGuard('jwt') to protect routes [OK]

Common Mistakes:

• Using local strategy guard to protect routes
• Skipping validate() method in strategy
• Applying AuthGuard without strategy name