Session-based authentication in NestJS - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to import the session middleware in a NestJS app.

NestJS

import * as session from '[1]';

Drag options to blanks, or click blank then click option'

Abody-parser

Bpassport

Ccookie-parser

Dexpress-session

Attempts:

3 left

💡 Hint

Common Mistakes

Importing the wrong middleware like cookie-parser or body-parser.

Forgetting to import any session middleware.

The express-session package is used to manage sessions in a NestJS app.

2fill in blank

medium

Complete the code to apply session middleware in the main app module.

NestJS

app.use(session({ secret: '[1]', resave: false, saveUninitialized: false }));

Drag options to blanks, or click blank then click option'

AmySecret

B12345

Ckeyboard cat

Dpassword

Attempts:

3 left

💡 Hint

Common Mistakes

Using an empty string or a weak secret.

Forgetting to set the secret property.

The secret is a string used to sign the session ID cookie. 'keyboard cat' is a common example.

3fill in blank

hard

Fix the error in the session configuration to avoid saving uninitialized sessions.

NestJS

app.use(session({ secret: 'keyboard cat', resave: false, saveUninitialized: [1] }));

Drag options to blanks, or click blank then click option'

Afalse

Bundefined

Cnull

Dtrue

Attempts:

3 left

💡 Hint

Common Mistakes

Setting saveUninitialized to true causes unnecessary session storage.

Using null or undefined causes configuration errors.

Setting saveUninitialized to false prevents saving empty sessions, improving performance and privacy.

4fill in blank

hard

Fill both blanks to configure cookie settings for secure sessions.

NestJS

app.use(session({ secret: 'keyboard cat', cookie: { secure: [1], maxAge: [2] } }));

Drag options to blanks, or click blank then click option'

Atrue

Bfalse

C60000

D3600000

Attempts:

3 left

💡 Hint

Common Mistakes

Setting secure to true without HTTPS causes cookies to not be sent.

Using too short or too long maxAge values.

For development, secure is false to allow HTTP. maxAge sets cookie life in milliseconds; 3600000 is 1 hour.

5fill in blank

hard

Fill all three blanks to create a session-based login route that saves user info.

NestJS

app.post('/login', (req, res) => {
  const { username } = req.body;
  req.session.[1] = [2];
  res.[3]('Logged in');
});

Drag options to blanks, or click blank then click option'

Auser

Busername

Csend

Djson

Attempts:

3 left

💡 Hint

Common Mistakes

Using req.session.username instead of req.session.user.

Using res.json() when a simple message is enough.

Forgetting to save user info in the session.

The session property user stores the username. The response uses send to reply with a message.

Practice

1. What is the main purpose of session-based authentication in NestJS?

easy

A. To keep user login information on the server for tracking user sessions

B. To store user passwords in the browser for quick access

C. To send user credentials with every request without storing them

D. To use tokens stored in local storage for authentication

Solution

1. Step 1: Understand session-based authentication

   Session-based authentication stores user info on the server to track login status across requests.

2. Step 2: Compare options with session concept

   Only To keep user login information on the server for tracking user sessions describes storing user login info on the server, which matches session-based authentication.

3. Final Answer:

   To keep user login information on the server for tracking user sessions -> Option A

4. Quick Check:

   Session stores user info on server = C [OK]

Hint: Sessions store user info on server, not client [OK]

Common Mistakes:

• Confusing sessions with token storage
• Thinking sessions store passwords in browser
• Believing credentials are sent every request without storage

2. Which of the following is the correct way to import session support in a NestJS module?

easy

A. import { SessionModule } from '@nestjs/session';

B. import { SessionModule } from '@nestjs/common';

C. import { SessionModule } from 'express-session';

D. import { SessionModule } from 'nestjs-session';

Solution

1. Step 1: Identify correct package for session in NestJS

   The official session support in NestJS is provided by '@nestjs/session'.

2. Step 2: Check import statements

   Only import { SessionModule } from '@nestjs/session'; imports SessionModule from '@nestjs/session', which is correct syntax.

3. Final Answer:

   import { SessionModule } from '@nestjs/session'; -> Option A

4. Quick Check:

   SessionModule from '@nestjs/session' = D [OK]

Hint: SessionModule comes from '@nestjs/session' package [OK]

Common Mistakes:

• Importing SessionModule from '@nestjs/common'
• Confusing express-session with NestJS module import
• Using incorrect package names

3. Given this NestJS controller snippet, what will be the output when a logged-in user accesses /profile?

import { Controller, Get, Req } from '@nestjs/common';

@Controller()
export class AppController {
  @Get('profile')
  getProfile(@Req() req) {
    if (req.session.user) {
      return `Hello, ${req.session.user.name}`;
    } else {
      return 'Not logged in';
    }
  }
}

medium

A. "Hello, undefined" if user exists but name is missing

B. "Not logged in" always

C. Throws an error because req.session is undefined

D. "Hello, Alice" if req.session.user.name is 'Alice'

Solution

1. Step 1: Check session user existence

   The code checks if req.session.user exists to decide output.

2. Step 2: Understand output when user exists

   If user exists with name 'Alice', it returns "Hello, Alice" string.

3. Final Answer:

   "Hello, Alice" if req.session.user.name is 'Alice' -> Option D

4. Quick Check:

   Session user present returns greeting = A [OK]

Hint: If session user exists, greet by name; else say not logged in [OK]

Common Mistakes:

• Assuming req.session is always undefined
• Ignoring the user existence check
• Confusing output strings

4. Identify the error in this NestJS session setup code:

import { Module } from '@nestjs/common';
import { SessionModule } from '@nestjs/session';

@Module({
  imports: [
    SessionModule.forRoot({
      secret: 'mySecret',
      resave: false,
      saveUninitialized: true,
    }),
  ],
})
export class AppModule {}

medium

A. Missing 'cookie' configuration inside forRoot options

B. The secret should be an environment variable, not a string literal

C. 'resave' and 'saveUninitialized' are not valid options for SessionModule

D. SessionModule.forRoot should be replaced with SessionModule.register

Solution

1. Step 1: Review SessionModule options

   In '@nestjs/session', options like 'resave' and 'saveUninitialized' are not valid; they belong to express-session directly.

2. Step 2: Identify correct option usage

   SessionModule expects options like 'secret' and 'cookie', but not 'resave' or 'saveUninitialized'.

3. Final Answer:

   'resave' and 'saveUninitialized' are not valid options for SessionModule -> Option C

4. Quick Check:

   Invalid options in SessionModule config = B [OK]

Hint: Check if options belong to NestJS SessionModule or express-session [OK]

Common Mistakes:

• Adding express-session options directly to SessionModule
• Confusing 'forRoot' with 'register'
• Ignoring required cookie config

5. You want to protect a NestJS route so only logged-in users with a session can access it. Which approach correctly checks the session and denies access if no user is logged in?

import { Controller, Get, Req, Res } from '@nestjs/common';
import { Response, Request } from 'express';

@Controller()
export class AppController {
  @Get('dashboard')
  dashboard(@Req() req: Request, @Res() res: Response) {
    // What should go here?
  }
}

hard

A. if (req.session.user === undefined) { throw new Error('No session'); } return 'Welcome';

B. if (!req.session.user) { return res.status(401).send('Unauthorized'); } return res.send('Welcome ' + req.session.user.name);

C. if (!req.session) { return 'Please login'; } return 'Dashboard';

D. if (req.session.user) { return 'Unauthorized'; } else { return 'Welcome'; }

Solution

1. Step 1: Check if user is logged in via session

   We verify if req.session.user exists; if not, deny access with 401 status.

2. Step 2: Return welcome message if user exists

   If user exists, send a welcome message with their name.

3. Final Answer:

   if (!req.session.user) { return res.status(401).send('Unauthorized'); } return res.send('Welcome ' + req.session.user.name); -> Option B

4. Quick Check:

   Check session user, deny if missing = A [OK]

Hint: Return 401 if no session user, else welcome [OK]

Common Mistakes:

• Throwing errors instead of sending HTTP response
• Checking only if req.session exists, not user
• Reversing logic for authorization