Session-based authentication in NestJS - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is session-based authentication?

Session-based authentication is a method where the server creates a session for a user after login and stores session data. The client keeps a session ID cookie to identify the session on future requests.

intermediate

How does NestJS handle sessions for authentication?

NestJS uses middleware like express-session to create and manage sessions. After login, session data is saved on the server, and a session cookie is sent to the client to maintain login state.

beginner

What role does the cookie play in session-based authentication?

The cookie stores the session ID on the client side. It is sent automatically with each request to the server, allowing the server to find the matching session and verify the user's identity.

intermediate

Why is it important to set 'httpOnly' and 'secure' flags on session cookies?

Setting 'httpOnly' prevents JavaScript access to cookies, reducing cross-site scripting risks. 'Secure' ensures cookies are sent only over HTTPS, protecting session data from being intercepted.

intermediate

How do you protect routes in NestJS to allow only authenticated users with sessions?

You use guards like AuthGuard that check if the session exists and is valid before allowing access. If no valid session is found, the guard blocks the request or redirects to login.

In session-based authentication, where is the session data stored?

A On the server

B In the client's local storage

C Inside the cookie itself

D In the URL parameters

Session data is stored on the server. The client only holds a session ID in a cookie.

Which NestJS middleware is commonly used to manage sessions?

A cors

B body-parser

C helmet

D express-session

express-session middleware is used to create and manage sessions in NestJS.

What does the 'httpOnly' flag on a cookie do?

A Prevents JavaScript from accessing the cookie

B Makes the cookie accessible only on HTTP, not HTTPS

C Allows the cookie to be shared across domains

D Encrypts the cookie content

'httpOnly' prevents JavaScript access to cookies, improving security.

How does the server identify a user in session-based authentication?

A By decoding a JWT token

B By checking the user's IP address

C By reading the session ID from the cookie sent by the client

D By reading user credentials from the request body

The server uses the session ID from the cookie to find the user's session.

What happens if a user tries to access a protected route without a valid session in NestJS?

A The user is granted access anyway

B The request is blocked or redirected to login

C The server creates a new session automatically

D The server returns a 500 error

Guards check for valid sessions and block or redirect unauthorized users.

Explain how session-based authentication works in NestJS from login to accessing protected routes.

Think about what happens step-by-step when a user logs in and then visits a page that needs login.

Describe the security best practices for session cookies in NestJS applications.

Focus on cookie flags and how they protect user sessions.