Session-based authentication in NestJS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when a user logs in with session-based authentication in NestJS?

Consider a NestJS app using session-based authentication. When a user logs in successfully, what is stored in the session?

A The user's ID or identifying info is saved in the session cookie on the client.

B A session ID is saved in the cookie, and user data is stored server-side linked to that ID.

C The entire user object is saved in the session cookie on the client.

D No data is saved; the server just remembers the login temporarily.

💡 Hint

Think about what data should stay private and where it is safest to store it.

In session-based authentication, the server stores user data linked to a session ID. The client only holds the session ID in a cookie. This keeps sensitive data secure on the server.

📝 Syntax

intermediate

Which NestJS code snippet correctly sets up session middleware for authentication?

Choose the correct way to configure session middleware in a NestJS app using express-session.

A app.use(session({ secret: 'secretKey', resave: false, saveUninitialized: false }));

B app.use(session({ secret: 'secretKey', resave: true, saveUninitialized: true }));

C app.use(session({ secret: 'secretKey' }));

D app.use(session({ resave: false, saveUninitialized: false }));

💡 Hint

Look for the option that includes all required properties with recommended values.

Option A correctly sets secret, disables resave, and disables saveUninitialized, which is a common secure setup.

🔧 Debug

advanced

Why does the session not persist after login in this NestJS code?

Given this NestJS controller snippet, the session does not persist after login. What is the likely cause?

async login(@Req() req) {
  req.session.user = { id: 1, name: 'Alice' };
  return 'Logged in';
}

A The session middleware is not applied before the controller runs.

B The user object is not serializable and causes an error.

C The session cookie is missing the HttpOnly flag.

D The controller method should return the session object.

💡 Hint

Think about middleware order and when sessions become available.

If session middleware is not set up before routes, req.session will be undefined or not saved, so session data won't persist.

❓ state_output

advanced

What is the value of req.session.user after logout in this NestJS example?

In this logout method, what will be the value of req.session.user after calling req.session.destroy()?

async logout(@Req() req) {
  req.session.destroy(err => {
    if (err) throw err;
  });
  return 'Logged out';
}

A It will throw an error when accessed.

B It will still hold the user object until the server restarts.

C It will be null but still accessible.

D It will be undefined because the session is destroyed.

💡 Hint

Consider what happens to session data after destroy is called.

Calling req.session.destroy removes the session data, so req.session.user becomes undefined.

🧠 Conceptual

expert

Why is session-based authentication considered stateful compared to token-based?

Choose the best explanation why session-based authentication is stateful while token-based is stateless.

A Session-based uses cookies, token-based uses local storage, so tokens are stateless.

B Session-based requires HTTPS, token-based does not, making tokens stateless.

C Session-based stores user state on the server, requiring server memory; token-based stores all info in the token, no server memory needed.

D Session-based uses encryption, token-based uses hashing, so tokens are stateless.

💡 Hint

Think about where user login info is stored and how the server tracks sessions.

Session-based auth keeps user info on the server linked to a session ID, so the server must remember state. Token-based auth encodes user info in the token itself, so the server does not store session state.