Session-based authentication in NestJS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when a user logs in with session-based authentication in NestJS?

Consider a NestJS app using session-based authentication. When a user logs in successfully, what is stored in the session?

A The user's ID or identifying info is saved in the session cookie on the client.

B A session ID is saved in the cookie, and user data is stored server-side linked to that ID.

C The entire user object is saved in the session cookie on the client.

D No data is saved; the server just remembers the login temporarily.

💡 Hint

Think about what data should stay private and where it is safest to store it.

In session-based authentication, the server stores user data linked to a session ID. The client only holds the session ID in a cookie. This keeps sensitive data secure on the server.

📝 Syntax

intermediate

Which NestJS code snippet correctly sets up session middleware for authentication?

Choose the correct way to configure session middleware in a NestJS app using express-session.

A app.use(session({ secret: 'secretKey', resave: false, saveUninitialized: false }));

B app.use(session({ secret: 'secretKey', resave: true, saveUninitialized: true }));

C app.use(session({ secret: 'secretKey' }));

D app.use(session({ resave: false, saveUninitialized: false }));

💡 Hint

Look for the option that includes all required properties with recommended values.

Option A correctly sets secret, disables resave, and disables saveUninitialized, which is a common secure setup.

🔧 Debug

advanced

Why does the session not persist after login in this NestJS code?

Given this NestJS controller snippet, the session does not persist after login. What is the likely cause?

async login(@Req() req) {
  req.session.user = { id: 1, name: 'Alice' };
  return 'Logged in';
}

A The session middleware is not applied before the controller runs.

B The user object is not serializable and causes an error.

C The session cookie is missing the HttpOnly flag.

D The controller method should return the session object.

💡 Hint

Think about middleware order and when sessions become available.

If session middleware is not set up before routes, req.session will be undefined or not saved, so session data won't persist.

❓ state_output

advanced

What is the value of req.session.user after logout in this NestJS example?

In this logout method, what will be the value of req.session.user after calling req.session.destroy()?

async logout(@Req() req) {
  req.session.destroy(err => {
    if (err) throw err;
  });
  return 'Logged out';
}

A It will throw an error when accessed.

B It will still hold the user object until the server restarts.

C It will be null but still accessible.

D It will be undefined because the session is destroyed.

💡 Hint

Consider what happens to session data after destroy is called.

Calling req.session.destroy removes the session data, so req.session.user becomes undefined.

🧠 Conceptual

expert

Why is session-based authentication considered stateful compared to token-based?

Choose the best explanation why session-based authentication is stateful while token-based is stateless.

A Session-based uses cookies, token-based uses local storage, so tokens are stateless.

B Session-based requires HTTPS, token-based does not, making tokens stateless.

C Session-based stores user state on the server, requiring server memory; token-based stores all info in the token, no server memory needed.

D Session-based uses encryption, token-based uses hashing, so tokens are stateless.

💡 Hint

Think about where user login info is stored and how the server tracks sessions.

Session-based auth keeps user info on the server linked to a session ID, so the server must remember state. Token-based auth encodes user info in the token itself, so the server does not store session state.

Practice

1. What is the main purpose of session-based authentication in NestJS?

easy

A. To keep user login information on the server for tracking user sessions

B. To store user passwords in the browser for quick access

C. To send user credentials with every request without storing them

D. To use tokens stored in local storage for authentication

Solution

1. Step 1: Understand session-based authentication

   Session-based authentication stores user info on the server to track login status across requests.

2. Step 2: Compare options with session concept

   Only To keep user login information on the server for tracking user sessions describes storing user login info on the server, which matches session-based authentication.

3. Final Answer:

   To keep user login information on the server for tracking user sessions -> Option A

4. Quick Check:

   Session stores user info on server = C [OK]

Hint: Sessions store user info on server, not client [OK]

Common Mistakes:

• Confusing sessions with token storage
• Thinking sessions store passwords in browser
• Believing credentials are sent every request without storage

2. Which of the following is the correct way to import session support in a NestJS module?

easy

A. import { SessionModule } from '@nestjs/session';

B. import { SessionModule } from '@nestjs/common';

C. import { SessionModule } from 'express-session';

D. import { SessionModule } from 'nestjs-session';

Solution

1. Step 1: Identify correct package for session in NestJS

   The official session support in NestJS is provided by '@nestjs/session'.

2. Step 2: Check import statements

   Only import { SessionModule } from '@nestjs/session'; imports SessionModule from '@nestjs/session', which is correct syntax.

3. Final Answer:

   import { SessionModule } from '@nestjs/session'; -> Option A

4. Quick Check:

   SessionModule from '@nestjs/session' = D [OK]

Hint: SessionModule comes from '@nestjs/session' package [OK]

Common Mistakes:

• Importing SessionModule from '@nestjs/common'
• Confusing express-session with NestJS module import
• Using incorrect package names

3. Given this NestJS controller snippet, what will be the output when a logged-in user accesses /profile?

import { Controller, Get, Req } from '@nestjs/common';

@Controller()
export class AppController {
  @Get('profile')
  getProfile(@Req() req) {
    if (req.session.user) {
      return `Hello, ${req.session.user.name}`;
    } else {
      return 'Not logged in';
    }
  }
}

medium

A. "Hello, undefined" if user exists but name is missing

B. "Not logged in" always

C. Throws an error because req.session is undefined

D. "Hello, Alice" if req.session.user.name is 'Alice'

Solution

1. Step 1: Check session user existence

   The code checks if req.session.user exists to decide output.

2. Step 2: Understand output when user exists

   If user exists with name 'Alice', it returns "Hello, Alice" string.

3. Final Answer:

   "Hello, Alice" if req.session.user.name is 'Alice' -> Option D

4. Quick Check:

   Session user present returns greeting = A [OK]

Hint: If session user exists, greet by name; else say not logged in [OK]

Common Mistakes:

• Assuming req.session is always undefined
• Ignoring the user existence check
• Confusing output strings

4. Identify the error in this NestJS session setup code:

import { Module } from '@nestjs/common';
import { SessionModule } from '@nestjs/session';

@Module({
  imports: [
    SessionModule.forRoot({
      secret: 'mySecret',
      resave: false,
      saveUninitialized: true,
    }),
  ],
})
export class AppModule {}

medium

A. Missing 'cookie' configuration inside forRoot options

B. The secret should be an environment variable, not a string literal

C. 'resave' and 'saveUninitialized' are not valid options for SessionModule

D. SessionModule.forRoot should be replaced with SessionModule.register

Solution

1. Step 1: Review SessionModule options

   In '@nestjs/session', options like 'resave' and 'saveUninitialized' are not valid; they belong to express-session directly.

2. Step 2: Identify correct option usage

   SessionModule expects options like 'secret' and 'cookie', but not 'resave' or 'saveUninitialized'.

3. Final Answer:

   'resave' and 'saveUninitialized' are not valid options for SessionModule -> Option C

4. Quick Check:

   Invalid options in SessionModule config = B [OK]

Hint: Check if options belong to NestJS SessionModule or express-session [OK]

Common Mistakes:

• Adding express-session options directly to SessionModule
• Confusing 'forRoot' with 'register'
• Ignoring required cookie config

5. You want to protect a NestJS route so only logged-in users with a session can access it. Which approach correctly checks the session and denies access if no user is logged in?

import { Controller, Get, Req, Res } from '@nestjs/common';
import { Response, Request } from 'express';

@Controller()
export class AppController {
  @Get('dashboard')
  dashboard(@Req() req: Request, @Res() res: Response) {
    // What should go here?
  }
}

hard

A. if (req.session.user === undefined) { throw new Error('No session'); } return 'Welcome';

B. if (!req.session.user) { return res.status(401).send('Unauthorized'); } return res.send('Welcome ' + req.session.user.name);

C. if (!req.session) { return 'Please login'; } return 'Dashboard';

D. if (req.session.user) { return 'Unauthorized'; } else { return 'Welcome'; }

Solution

1. Step 1: Check if user is logged in via session

   We verify if req.session.user exists; if not, deny access with 401 status.

2. Step 2: Return welcome message if user exists

   If user exists, send a welcome message with their name.

3. Final Answer:

   if (!req.session.user) { return res.status(401).send('Unauthorized'); } return res.send('Welcome ' + req.session.user.name); -> Option B

4. Quick Check:

   Check session user, deny if missing = A [OK]

Hint: Return 401 if no session user, else welcome [OK]

Common Mistakes:

• Throwing errors instead of sending HTTP response
• Checking only if req.session exists, not user
• Reversing logic for authorization