Refresh token pattern in NestJS - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of a refresh token in authentication?

A refresh token is used to get a new access token without asking the user to log in again. It helps keep the user logged in securely for a longer time.

beginner

In NestJS, where is the refresh token usually stored on the client side?

The refresh token is usually stored in an HTTP-only cookie to protect it from JavaScript access and reduce security risks like XSS attacks.

intermediate

How does the refresh token pattern improve security compared to long-lived access tokens?

It limits the lifespan of access tokens, so if an access token is stolen, it expires quickly. The refresh token is stored securely and used to get new access tokens, reducing risk.

intermediate

What is a common NestJS practice to validate refresh tokens?

Use a guard or middleware to check the refresh token's validity, often by verifying its signature and checking it against a stored token in the database or cache.

advanced

Why should refresh tokens be rotated in NestJS applications?

Rotating refresh tokens means issuing a new refresh token each time one is used. This prevents reuse of old tokens and improves security by limiting token theft impact.

What does a refresh token do in a NestJS authentication flow?

A It issues a new access token without user login

B It logs the user out

C It stores user credentials

D It encrypts the access token

A refresh token allows the client to get a new access token without requiring the user to log in again.

Where is the safest place to store a refresh token on the client side?

A Local storage

B In-memory variable

C Session storage

D HTTP-only cookie

HTTP-only cookies prevent JavaScript access, reducing risks like cross-site scripting (XSS).

What is a key benefit of rotating refresh tokens?

A Prevents reuse of stolen tokens

B Improves UI responsiveness

C Reduces server load

D Simplifies token storage

Rotating refresh tokens means old tokens can't be reused if stolen, enhancing security.

In NestJS, how can you verify a refresh token?

A By sending it to the client

B By storing it in local storage

C By checking its signature and expiration

D By hashing the access token

Verification involves checking the token's signature and expiration to ensure it is valid.

Why not use long-lived access tokens instead of refresh tokens?

A Long-lived tokens are harder to generate

B Long-lived tokens increase security risks if stolen

C Refresh tokens are faster to use

D Access tokens cannot expire

Long-lived access tokens can be used by attackers for a longer time if stolen, so short-lived tokens with refresh tokens are safer.

Explain the refresh token pattern and why it is important in NestJS authentication.

Think about how to keep users logged in without asking for passwords repeatedly.

Describe how you would implement refresh token validation and rotation in a NestJS app.

Focus on security steps to prevent token misuse.

Practice

1. What is the main purpose of using a refresh token in a NestJS authentication system?

easy

A. To store user credentials securely on the client side

B. To replace the access token permanently

C. To issue a new access token without requiring the user to log in again

D. To encrypt the user's password

Solution

1. Step 1: Understand token roles in authentication

   Access tokens allow access but expire quickly; refresh tokens help get new access tokens without re-login.

2. Step 2: Identify refresh token purpose

   Refresh tokens are used to request new access tokens after expiration, keeping the user logged in safely.

3. Final Answer:

   To issue a new access token without requiring the user to log in again -> Option C

4. Quick Check:

   Refresh token = new access token without re-login [OK]

Hint: Refresh tokens renew access tokens without user login [OK]

Common Mistakes:

• Confusing refresh token with access token
• Thinking refresh token stores user credentials
• Assuming refresh token replaces access token permanently

2. Which of the following is the correct way to verify a refresh token in a NestJS service using JWT?

easy

A. jwtService.verify(refreshToken)

B. jwtService.encrypt(refreshToken)

C. jwtService.decode(accessToken)

D. jwtService.sign(payload)

Solution

1. Step 1: Identify JWT methods for token verification

   In NestJS, jwtService.verify() checks token validity and signature.

2. Step 2: Match method to refresh token verification

   To verify a refresh token, use jwtService.verify(refreshToken) to confirm it is valid and not expired.

3. Final Answer:

   jwtService.verify(refreshToken) -> Option A

4. Quick Check:

   Verify token = jwtService.verify() [OK]

Hint: Use jwtService.verify() to check token validity [OK]

Common Mistakes:

• Using sign() instead of verify() to check tokens
• Using decode() which does not verify signature
• Trying to encrypt tokens with jwtService

3. Given this NestJS code snippet, what will be the output if the refresh token is valid?

async refreshToken(token: string) {
  try {
    const payload = this.jwtService.verify(token);
    const newAccessToken = this.jwtService.sign({ userId: payload.sub });
    return { accessToken: newAccessToken };
  } catch (e) {
    throw new UnauthorizedException('Invalid refresh token');
  }
}

medium

A. Throws UnauthorizedException with message 'Invalid refresh token'

B. { accessToken: 'newly_generated_token_string' }

C. Returns the original refresh token

D. Returns null

Solution

1. Step 1: Analyze token verification

   The code verifies the refresh token; if valid, it extracts the payload.

2. Step 2: Generate new access token

   Using the payload's user ID, it signs a new access token and returns it in an object.

3. Final Answer:

   { accessToken: 'newly_generated_token_string' } -> Option B

4. Quick Check:

   Valid refresh token returns new access token [OK]

Hint: Valid token returns new access token object [OK]

Common Mistakes:

• Assuming it returns the refresh token again
• Thinking it throws error on valid token
• Expecting null instead of token object

4. Identify the bug in this NestJS refresh token handler:

async refreshToken(token: string) {
  const payload = this.jwtService.verify(token);
  const newAccessToken = this.jwtService.sign({ userId: payload.userId });
  return { accessToken: newAccessToken };
}

medium

A. Missing try-catch block to handle invalid tokens

B. Using sign() instead of verify() for token validation

C. Returning access token as a string instead of an object

D. Incorrect property name 'userId' instead of 'sub' in payload

Solution

1. Step 1: Check payload property usage

   JWT payload usually stores user ID in 'sub' property, not 'userId'.

2. Step 2: Identify mismatch causing error

   Accessing 'payload.userId' will be undefined, causing incorrect token signing.

3. Final Answer:

   Incorrect property name 'userId' instead of 'sub' in payload -> Option D

4. Quick Check:

   JWT user ID = payload.sub, not payload.userId [OK]

Hint: Check JWT payload keys carefully (usually 'sub') [OK]

Common Mistakes:

• Ignoring missing try-catch for errors
• Assuming payload uses 'userId' key
• Confusing sign() and verify() methods

5. You want to implement a refresh token system in NestJS that invalidates old refresh tokens after use. Which approach correctly achieves this?

hard

A. Store refresh tokens in a database and delete the old token when issuing a new one

B. Generate refresh tokens without storing them and rely on JWT expiration only

C. Use the same refresh token indefinitely without expiration

D. Send the access token as the refresh token

Solution

1. Step 1: Understand token invalidation

   To invalidate old refresh tokens, you must track them server-side, usually in a database.

2. Step 2: Implement token replacement logic

   When issuing a new refresh token, delete or mark the old one invalid in the database to prevent reuse.

3. Final Answer:

   Store refresh tokens in a database and delete the old token when issuing a new one -> Option A

4. Quick Check:

   Invalidate old tokens by storing and deleting them [OK]

Hint: Track refresh tokens server-side to invalidate old ones [OK]

Common Mistakes:

• Not storing tokens, so can't invalidate old ones
• Using refresh tokens without expiration
• Confusing access token with refresh token