Refresh token pattern in NestJS - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to import the module needed for JWT in NestJS.

NestJS

import { [1] } from '@nestjs/jwt';

Drag options to blanks, or click blank then click option'

AJwtModule

BJwtGuard

CJwtStrategy

DJwtService

Attempts:

3 left

💡 Hint

Common Mistakes

Choosing JwtService instead of JwtModule

Confusing JwtStrategy with JwtModule

The JwtModule is imported to configure JWT in NestJS.

2fill in blank

medium

Complete the code to register JwtModule with a secret key.

NestJS

JwtModule.register({ secret: '[1]' })

Drag options to blanks, or click blank then click option'

AjwtSecret

BrefreshSecret

CmySecretKey

DaccessSecret

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'mySecretKey' which is generic

Using 'refreshSecret' which is usually for refresh tokens

The secret key is usually named jwtSecret or similar to sign tokens.

3fill in blank

hard

Fix the error in the method that signs a refresh token with expiration.

NestJS

async generateRefreshToken(userId: string) {
  return this.jwtService.[1]({ userId }, { expiresIn: '7d' });
}

Drag options to blanks, or click blank then click option'

AcreateToken

BsignAsync

CgenerateToken

Dsign

Attempts:

3 left

💡 Hint

Common Mistakes

Using non-existent signAsync

Using non-existent methods like createToken

The sign method is used to create tokens synchronously in NestJS JwtService.

4fill in blank

hard

Fill both blanks to create a refresh token validation guard.

NestJS

import { Injectable, CanActivate, ExecutionContext } from '@nestjs/common';
import { JwtService } from '@nestjs/jwt';

@Injectable()
export class RefreshTokenGuard implements CanActivate {
  constructor(private readonly jwtService: JwtService) {}

  async canActivate(context: ExecutionContext): Promise<boolean> {
    const request = context.switchToHttp().getRequest();
    const token = request.headers['[1]'];
    try {
      const payload = await this.jwtService.[2](token);
      return !!payload;
    } catch {
      return false;
    }
  }
}

Drag options to blanks, or click blank then click option'

Aauthorization

Bverify

Crefresh-token

Ddecode

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'refresh-token' header which is uncommon

Using decode instead of verify causing no validation

The refresh token is usually sent in the authorization header, and verify checks its validity.

5fill in blank

hard

Fill all three blanks to implement a refresh token service method that validates and issues a new access token.

NestJS

async refreshTokens(refreshToken: string) {
  const payload = await this.jwtService.[1](refreshToken);
  if (!payload) throw new Error('Invalid token');
  const userId = payload.[2];
  const newAccessToken = await this.jwtService.[3]({ userId }, { expiresIn: '15m' });
  return { accessToken: newAccessToken };
}

Drag options to blanks, or click blank then click option'

Averify

BuserId

Csign

Ddecode

Attempts:

3 left

💡 Hint

Common Mistakes

Using decode instead of verify causing no validation

Accessing wrong payload property

Using non-existent signAsync

First, verify checks the refresh token. Then, the userId is extracted from the payload. Finally, sign creates a new access token.

Practice

1. What is the main purpose of using a refresh token in a NestJS authentication system?

easy

A. To store user credentials securely on the client side

B. To replace the access token permanently

C. To issue a new access token without requiring the user to log in again

D. To encrypt the user's password

Solution

1. Step 1: Understand token roles in authentication

   Access tokens allow access but expire quickly; refresh tokens help get new access tokens without re-login.

2. Step 2: Identify refresh token purpose

   Refresh tokens are used to request new access tokens after expiration, keeping the user logged in safely.

3. Final Answer:

   To issue a new access token without requiring the user to log in again -> Option C

4. Quick Check:

   Refresh token = new access token without re-login [OK]

Hint: Refresh tokens renew access tokens without user login [OK]

Common Mistakes:

• Confusing refresh token with access token
• Thinking refresh token stores user credentials
• Assuming refresh token replaces access token permanently

2. Which of the following is the correct way to verify a refresh token in a NestJS service using JWT?

easy

A. jwtService.verify(refreshToken)

B. jwtService.encrypt(refreshToken)

C. jwtService.decode(accessToken)

D. jwtService.sign(payload)

Solution

1. Step 1: Identify JWT methods for token verification

   In NestJS, jwtService.verify() checks token validity and signature.

2. Step 2: Match method to refresh token verification

   To verify a refresh token, use jwtService.verify(refreshToken) to confirm it is valid and not expired.

3. Final Answer:

   jwtService.verify(refreshToken) -> Option A

4. Quick Check:

   Verify token = jwtService.verify() [OK]

Hint: Use jwtService.verify() to check token validity [OK]

Common Mistakes:

• Using sign() instead of verify() to check tokens
• Using decode() which does not verify signature
• Trying to encrypt tokens with jwtService

3. Given this NestJS code snippet, what will be the output if the refresh token is valid?

async refreshToken(token: string) {
  try {
    const payload = this.jwtService.verify(token);
    const newAccessToken = this.jwtService.sign({ userId: payload.sub });
    return { accessToken: newAccessToken };
  } catch (e) {
    throw new UnauthorizedException('Invalid refresh token');
  }
}

medium

A. Throws UnauthorizedException with message 'Invalid refresh token'

B. { accessToken: 'newly_generated_token_string' }

C. Returns the original refresh token

D. Returns null

Solution

1. Step 1: Analyze token verification

   The code verifies the refresh token; if valid, it extracts the payload.

2. Step 2: Generate new access token

   Using the payload's user ID, it signs a new access token and returns it in an object.

3. Final Answer:

   { accessToken: 'newly_generated_token_string' } -> Option B

4. Quick Check:

   Valid refresh token returns new access token [OK]

Hint: Valid token returns new access token object [OK]

Common Mistakes:

• Assuming it returns the refresh token again
• Thinking it throws error on valid token
• Expecting null instead of token object

4. Identify the bug in this NestJS refresh token handler:

async refreshToken(token: string) {
  const payload = this.jwtService.verify(token);
  const newAccessToken = this.jwtService.sign({ userId: payload.userId });
  return { accessToken: newAccessToken };
}

medium

A. Missing try-catch block to handle invalid tokens

B. Using sign() instead of verify() for token validation

C. Returning access token as a string instead of an object

D. Incorrect property name 'userId' instead of 'sub' in payload

Solution

1. Step 1: Check payload property usage

   JWT payload usually stores user ID in 'sub' property, not 'userId'.

2. Step 2: Identify mismatch causing error

   Accessing 'payload.userId' will be undefined, causing incorrect token signing.

3. Final Answer:

   Incorrect property name 'userId' instead of 'sub' in payload -> Option D

4. Quick Check:

   JWT user ID = payload.sub, not payload.userId [OK]

Hint: Check JWT payload keys carefully (usually 'sub') [OK]

Common Mistakes:

• Ignoring missing try-catch for errors
• Assuming payload uses 'userId' key
• Confusing sign() and verify() methods

5. You want to implement a refresh token system in NestJS that invalidates old refresh tokens after use. Which approach correctly achieves this?

hard

A. Store refresh tokens in a database and delete the old token when issuing a new one

B. Generate refresh tokens without storing them and rely on JWT expiration only

C. Use the same refresh token indefinitely without expiration

D. Send the access token as the refresh token

Solution

1. Step 1: Understand token invalidation

   To invalidate old refresh tokens, you must track them server-side, usually in a database.

2. Step 2: Implement token replacement logic

   When issuing a new refresh token, delete or mark the old one invalid in the database to prevent reuse.

3. Final Answer:

   Store refresh tokens in a database and delete the old token when issuing a new one -> Option A

4. Quick Check:

   Invalidate old tokens by storing and deleting them [OK]

Hint: Track refresh tokens server-side to invalidate old ones [OK]

Common Mistakes:

• Not storing tokens, so can't invalidate old ones
• Using refresh tokens without expiration
• Confusing access token with refresh token