Session-based authentication in NestJS - Mini Project: Build & Apply

Session-based authentication with NestJS

📖 Scenario: You are building a simple web application that needs to remember users after they log in. To do this, you will use session-based authentication in NestJS. This means the server will keep track of who is logged in by storing information in a session.

🎯 Goal: Create a NestJS setup that uses session-based authentication. You will start by setting up the session data, then configure the session middleware, implement login logic to save user info in the session, and finally add a route that checks if a user is logged in by reading the session.

📋 What You'll Learn

Create a session object to hold user data

Configure session middleware with a secret key

Implement a login route that saves user info in the session

Add a protected route that checks session data to confirm login

💡 Why This Matters

🌍 Real World

Session-based authentication is used in many web apps to remember users after they log in, so they don't have to enter their credentials every time.

💼 Career

Understanding session management is important for backend developers working with web frameworks like NestJS to build secure and user-friendly applications.

1

Set up the session data structure

Create a variable called session as an empty object to hold user session data.

NestJS

# Your code here
# Create a variable called session as an empty object

Hint

Think of session as a box where you will store user info after login.

2

Configure session middleware

Add a constant called sessionConfig with a property secret set to the string 'mySecretKey' to configure session middleware.

NestJS

const session = {};
// Add sessionConfig with secret 'mySecretKey' below
# Your code here

Hint

The secret key helps keep session data safe.

3

Implement login logic to save user info in session

Write a function called loginUser that takes a parameter username and saves it in the session object under the key user.

NestJS

const session = {};
const sessionConfig = { secret: 'mySecretKey' };

// Write loginUser function below
# Your code here

Hint

This function saves the username in the session so the server remembers who is logged in.

4

Add a route to check if user is logged in

Create a function called isLoggedIn that returns true if session.user exists, otherwise returns false.

NestJS

const session = {};
const sessionConfig = { secret: 'mySecretKey' };

function loginUser(username) {
    session.user = username;
}

// Write isLoggedIn function below
# Your code here

Hint

This function checks if the user is saved in the session to confirm login status.

Practice

1. What is the main purpose of session-based authentication in NestJS?

easy

A. To keep user login information on the server for tracking user sessions

B. To store user passwords in the browser for quick access

C. To send user credentials with every request without storing them

D. To use tokens stored in local storage for authentication

Solution

1. Step 1: Understand session-based authentication

   Session-based authentication stores user info on the server to track login status across requests.

2. Step 2: Compare options with session concept

   Only To keep user login information on the server for tracking user sessions describes storing user login info on the server, which matches session-based authentication.

3. Final Answer:

   To keep user login information on the server for tracking user sessions -> Option A

4. Quick Check:

   Session stores user info on server = C [OK]

Hint: Sessions store user info on server, not client [OK]

Common Mistakes:

• Confusing sessions with token storage
• Thinking sessions store passwords in browser
• Believing credentials are sent every request without storage

2. Which of the following is the correct way to import session support in a NestJS module?

easy

A. import { SessionModule } from '@nestjs/session';

B. import { SessionModule } from '@nestjs/common';

C. import { SessionModule } from 'express-session';

D. import { SessionModule } from 'nestjs-session';

Solution

1. Step 1: Identify correct package for session in NestJS

   The official session support in NestJS is provided by '@nestjs/session'.

2. Step 2: Check import statements

   Only import { SessionModule } from '@nestjs/session'; imports SessionModule from '@nestjs/session', which is correct syntax.

3. Final Answer:

   import { SessionModule } from '@nestjs/session'; -> Option A

4. Quick Check:

   SessionModule from '@nestjs/session' = D [OK]

Hint: SessionModule comes from '@nestjs/session' package [OK]

Common Mistakes:

• Importing SessionModule from '@nestjs/common'
• Confusing express-session with NestJS module import
• Using incorrect package names

3. Given this NestJS controller snippet, what will be the output when a logged-in user accesses /profile?

import { Controller, Get, Req } from '@nestjs/common';

@Controller()
export class AppController {
  @Get('profile')
  getProfile(@Req() req) {
    if (req.session.user) {
      return `Hello, ${req.session.user.name}`;
    } else {
      return 'Not logged in';
    }
  }
}

medium

A. "Hello, undefined" if user exists but name is missing

B. "Not logged in" always

C. Throws an error because req.session is undefined

D. "Hello, Alice" if req.session.user.name is 'Alice'

Solution

1. Step 1: Check session user existence

   The code checks if req.session.user exists to decide output.

2. Step 2: Understand output when user exists

   If user exists with name 'Alice', it returns "Hello, Alice" string.

3. Final Answer:

   "Hello, Alice" if req.session.user.name is 'Alice' -> Option D

4. Quick Check:

   Session user present returns greeting = A [OK]

Hint: If session user exists, greet by name; else say not logged in [OK]

Common Mistakes:

• Assuming req.session is always undefined
• Ignoring the user existence check
• Confusing output strings

4. Identify the error in this NestJS session setup code:

import { Module } from '@nestjs/common';
import { SessionModule } from '@nestjs/session';

@Module({
  imports: [
    SessionModule.forRoot({
      secret: 'mySecret',
      resave: false,
      saveUninitialized: true,
    }),
  ],
})
export class AppModule {}

medium

A. Missing 'cookie' configuration inside forRoot options

B. The secret should be an environment variable, not a string literal

C. 'resave' and 'saveUninitialized' are not valid options for SessionModule

D. SessionModule.forRoot should be replaced with SessionModule.register

Solution

1. Step 1: Review SessionModule options

   In '@nestjs/session', options like 'resave' and 'saveUninitialized' are not valid; they belong to express-session directly.

2. Step 2: Identify correct option usage

   SessionModule expects options like 'secret' and 'cookie', but not 'resave' or 'saveUninitialized'.

3. Final Answer:

   'resave' and 'saveUninitialized' are not valid options for SessionModule -> Option C

4. Quick Check:

   Invalid options in SessionModule config = B [OK]

Hint: Check if options belong to NestJS SessionModule or express-session [OK]

Common Mistakes:

• Adding express-session options directly to SessionModule
• Confusing 'forRoot' with 'register'
• Ignoring required cookie config

5. You want to protect a NestJS route so only logged-in users with a session can access it. Which approach correctly checks the session and denies access if no user is logged in?

import { Controller, Get, Req, Res } from '@nestjs/common';
import { Response, Request } from 'express';

@Controller()
export class AppController {
  @Get('dashboard')
  dashboard(@Req() req: Request, @Res() res: Response) {
    // What should go here?
  }
}

hard

A. if (req.session.user === undefined) { throw new Error('No session'); } return 'Welcome';

B. if (!req.session.user) { return res.status(401).send('Unauthorized'); } return res.send('Welcome ' + req.session.user.name);

C. if (!req.session) { return 'Please login'; } return 'Dashboard';

D. if (req.session.user) { return 'Unauthorized'; } else { return 'Welcome'; }

Solution

1. Step 1: Check if user is logged in via session

   We verify if req.session.user exists; if not, deny access with 401 status.

2. Step 2: Return welcome message if user exists

   If user exists, send a welcome message with their name.

3. Final Answer:

   if (!req.session.user) { return res.status(401).send('Unauthorized'); } return res.send('Welcome ' + req.session.user.name); -> Option B

4. Quick Check:

   Check session user, deny if missing = A [OK]

Hint: Return 401 if no session user, else welcome [OK]

Common Mistakes:

• Throwing errors instead of sending HTTP response
• Checking only if req.session exists, not user
• Reversing logic for authorization