Refresh token pattern in NestJS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when a refresh token is expired in this NestJS service?

Consider this NestJS AuthService method that handles refresh tokens. What will be the result if the refresh token is expired?

NestJS

async refreshToken(userId: string, refreshToken: string) {
  const user = await this.userService.findById(userId);
  if (!user || user.refreshToken !== refreshToken) {
    throw new UnauthorizedException('Invalid refresh token');
  }
  try {
    const payload = this.jwtService.verify(refreshToken);
    const newAccessToken = this.jwtService.sign({ sub: userId });
    return { accessToken: newAccessToken };
  } catch (e) {
    throw new UnauthorizedException('Refresh token expired');
  }
}

A The method returns a new access token ignoring the expired refresh token.

B The method returns null without throwing an error.

C The method throws UnauthorizedException with message 'Refresh token expired'.

D The method throws a NotFoundException because the user is not found.

💡 Hint

Look at the try-catch block and what happens when jwtService.verify fails.

When the refresh token is expired, jwtService.verify throws an error caught by the catch block, which then throws UnauthorizedException with message 'Refresh token expired'.

📝 Syntax

intermediate

Which option correctly defines a NestJS guard to check refresh token validity?

You want to create a guard that checks if the refresh token in the request headers is valid. Which code snippet is syntactically correct and follows NestJS patterns?

A

import { Injectable, CanActivate, ExecutionContext } from '@nestjs/common';

@Injectable()
export class RefreshTokenGuard {
  canActivate(context: ExecutionContext): boolean {
    const request = context.switchToHttp().getRequest();
    const token = request.headers['refresh-token'];
    return token === 'valid-token';
  }
}

B

import { CanActivate, ExecutionContext } from '@nestjs/common';

export class RefreshTokenGuard implements CanActivate {
  canActivate(context: ExecutionContext) {
    const request = context.getRequest();
    const token = request.headers['refresh-token'];
    return token === 'valid-token';
  }
}

C

import { Injectable, CanActivate, ExecutionContext } from '@nestjs/common';

@Injectable()
export class RefreshTokenGuard implements CanActivate {
  canActivate(context: ExecutionContext): boolean {
    const request = context.switchToHttp().getRequest();
    const token = request.headers['refresh-token'];
    return token === 'valid-token';
  }
}

D

import { CanActivate, ExecutionContext, Injectable } from '@nestjs/common';

@Injectable()
export class RefreshTokenGuard implements CanActivate {
  canActivate(context: ExecutionContext): boolean {
    const request = context.switchToHttp().getRequest();
    const token = request.headers['refresh-token'];
    return token === 'valid-token';
  }
}

💡 Hint

Check for correct decorator usage and method signatures.

Option D correctly imports Injectable and CanActivate, uses @Injectable() decorator, and implements canActivate with proper context usage.

❓ state_output

advanced

What is the output of this refresh token service method after multiple calls?

Given this simplified NestJS AuthService snippet, what will be the value of user.refreshToken after calling refreshToken twice with the same initial refresh token?

NestJS

class AuthService {
  constructor(private userService) {}

  async refreshToken(userId, refreshToken) {
    const user = await this.userService.findById(userId);
    if (!user || user.refreshToken !== refreshToken) {
      throw new Error('Invalid refresh token');
    }
    const newRefreshToken = 'new-token-' + Math.random();
    user.refreshToken = newRefreshToken;
    await this.userService.update(userId, { refreshToken: newRefreshToken });
    return { accessToken: 'access-token', refreshToken: newRefreshToken };
  }
}

// Initial user.refreshToken = 'initial-token'

// Call 1: refreshToken(userId, 'initial-token')
// Call 2: refreshToken(userId, 'initial-token')

A The second call throws an error because the refresh token no longer matches the stored one.

B The second call returns a new refresh token and updates user.refreshToken again.

C The second call returns the same refresh token as the first call without error.

D The second call returns null because the refresh token is invalid.

💡 Hint

Think about how the stored refresh token changes after the first call.

After the first call, user.refreshToken is updated to a new random token. The second call uses the old token, which no longer matches, causing an error.

🔧 Debug

advanced

Why does this NestJS refresh token validation always fail?

Look at this code snippet from a NestJS AuthService. The refresh token validation always fails even with a correct token. What is the bug?

NestJS

async validateRefreshToken(userId: string, token: string) {
  const user = await this.userService.findById(userId);
  if (!user) return false;
  try {
    this.jwtService.verify(token, { secret: process.env.JWT_SECRET });
  } catch {
    return false;
  }
  return user.refreshToken === token;
}

A The secret used in verify is incorrect, so tokens never validate.

B jwtService.verify throws an error on invalid token but is used as a boolean, causing unhandled exceptions.

C The method should compare user.refreshToken before calling jwtService.verify.

D The method returns false because user.refreshToken is undefined.

💡 Hint

Check how jwtService.verify behaves on invalid tokens.

jwtService.verify throws an exception if the token is invalid. Using it as a boolean without try-catch causes the method to fail unexpectedly.

🧠 Conceptual

expert

Which statement best describes the security benefit of rotating refresh tokens in NestJS?

In a NestJS app implementing refresh token rotation, what is the main security advantage of issuing a new refresh token on each refresh request?

A It limits the window for token theft by invalidating old refresh tokens after use.

B It allows multiple devices to share the same refresh token safely.

C It eliminates the need for access tokens entirely.

D It reduces server load by caching refresh tokens longer.

💡 Hint

Think about what happens if a refresh token is stolen and rotation is used.

Rotating refresh tokens means each token can only be used once, so if a token is stolen, it quickly becomes useless, improving security.

Practice

1. What is the main purpose of using a refresh token in a NestJS authentication system?

easy

A. To store user credentials securely on the client side

B. To replace the access token permanently

C. To issue a new access token without requiring the user to log in again

D. To encrypt the user's password

Solution

1. Step 1: Understand token roles in authentication

   Access tokens allow access but expire quickly; refresh tokens help get new access tokens without re-login.

2. Step 2: Identify refresh token purpose

   Refresh tokens are used to request new access tokens after expiration, keeping the user logged in safely.

3. Final Answer:

   To issue a new access token without requiring the user to log in again -> Option C

4. Quick Check:

   Refresh token = new access token without re-login [OK]

Hint: Refresh tokens renew access tokens without user login [OK]

Common Mistakes:

• Confusing refresh token with access token
• Thinking refresh token stores user credentials
• Assuming refresh token replaces access token permanently

2. Which of the following is the correct way to verify a refresh token in a NestJS service using JWT?

easy

A. jwtService.verify(refreshToken)

B. jwtService.encrypt(refreshToken)

C. jwtService.decode(accessToken)

D. jwtService.sign(payload)

Solution

1. Step 1: Identify JWT methods for token verification

   In NestJS, jwtService.verify() checks token validity and signature.

2. Step 2: Match method to refresh token verification

   To verify a refresh token, use jwtService.verify(refreshToken) to confirm it is valid and not expired.

3. Final Answer:

   jwtService.verify(refreshToken) -> Option A

4. Quick Check:

   Verify token = jwtService.verify() [OK]

Hint: Use jwtService.verify() to check token validity [OK]

Common Mistakes:

• Using sign() instead of verify() to check tokens
• Using decode() which does not verify signature
• Trying to encrypt tokens with jwtService

3. Given this NestJS code snippet, what will be the output if the refresh token is valid?

async refreshToken(token: string) {
  try {
    const payload = this.jwtService.verify(token);
    const newAccessToken = this.jwtService.sign({ userId: payload.sub });
    return { accessToken: newAccessToken };
  } catch (e) {
    throw new UnauthorizedException('Invalid refresh token');
  }
}

medium

A. Throws UnauthorizedException with message 'Invalid refresh token'

B. { accessToken: 'newly_generated_token_string' }

C. Returns the original refresh token

D. Returns null

Solution

1. Step 1: Analyze token verification

   The code verifies the refresh token; if valid, it extracts the payload.

2. Step 2: Generate new access token

   Using the payload's user ID, it signs a new access token and returns it in an object.

3. Final Answer:

   { accessToken: 'newly_generated_token_string' } -> Option B

4. Quick Check:

   Valid refresh token returns new access token [OK]

Hint: Valid token returns new access token object [OK]

Common Mistakes:

• Assuming it returns the refresh token again
• Thinking it throws error on valid token
• Expecting null instead of token object

4. Identify the bug in this NestJS refresh token handler:

async refreshToken(token: string) {
  const payload = this.jwtService.verify(token);
  const newAccessToken = this.jwtService.sign({ userId: payload.userId });
  return { accessToken: newAccessToken };
}

medium

A. Missing try-catch block to handle invalid tokens

B. Using sign() instead of verify() for token validation

C. Returning access token as a string instead of an object

D. Incorrect property name 'userId' instead of 'sub' in payload

Solution

1. Step 1: Check payload property usage

   JWT payload usually stores user ID in 'sub' property, not 'userId'.

2. Step 2: Identify mismatch causing error

   Accessing 'payload.userId' will be undefined, causing incorrect token signing.

3. Final Answer:

   Incorrect property name 'userId' instead of 'sub' in payload -> Option D

4. Quick Check:

   JWT user ID = payload.sub, not payload.userId [OK]

Hint: Check JWT payload keys carefully (usually 'sub') [OK]

Common Mistakes:

• Ignoring missing try-catch for errors
• Assuming payload uses 'userId' key
• Confusing sign() and verify() methods

5. You want to implement a refresh token system in NestJS that invalidates old refresh tokens after use. Which approach correctly achieves this?

hard

A. Store refresh tokens in a database and delete the old token when issuing a new one

B. Generate refresh tokens without storing them and rely on JWT expiration only

C. Use the same refresh token indefinitely without expiration

D. Send the access token as the refresh token

Solution

1. Step 1: Understand token invalidation

   To invalidate old refresh tokens, you must track them server-side, usually in a database.

2. Step 2: Implement token replacement logic

   When issuing a new refresh token, delete or mark the old one invalid in the database to prevent reuse.

3. Final Answer:

   Store refresh tokens in a database and delete the old token when issuing a new one -> Option A

4. Quick Check:

   Invalidate old tokens by storing and deleting them [OK]

Hint: Track refresh tokens server-side to invalidate old ones [OK]

Common Mistakes:

• Not storing tokens, so can't invalidate old ones
• Using refresh tokens without expiration
• Confusing access token with refresh token