Session-based authentication in NestJS - Step-by-Step Execution

Concept Flow - Session-based authentication

User sends login request

↓

Server verifies credentials

Yes↓

Server creates session

↓

Session ID stored in cookie

↓

User sends requests with cookie

↓

Server checks session ID

↓

Server grants access

↓

End

No↓

Server denies access

↓

End

User logs in, server checks credentials, creates a session, stores session ID in cookie, then checks session on each request to allow or deny access.

Execution Sample

NestJS

import { Controller, Post, Req, Res } from '@nestjs/common';
import * as session from 'express-session';

@Controller('auth')
export class AuthController {
  @Post('login')
  login(@Req() req, @Res() res) {
    if (req.body.user === 'admin' && req.body.pass === '123') {
      req.session.user = 'admin';
      res.send('Logged in');
    } else {
      res.status(401).send('Unauthorized');
    }
  }
}

This code checks user credentials, creates a session if valid, and sends a response.

Execution Table

Step	Action	Input	Session State	Response
1	User sends login request	{user:'admin', pass:'123'}	{}	Pending
2	Server checks credentials	user='admin', pass='123'	{}	Pending
3	Credentials valid?	Yes	{}	Pending
4	Create session	Set req.session.user='admin'	{user:'admin'}	Pending
5	Send response	Session created	{user:'admin'}	'Logged in' with Set-Cookie
6	User sends request with cookie	Cookie with session ID	{user:'admin'}	Pending
7	Server checks session ID	Session ID valid	{user:'admin'}	Pending
8	Grant access	Session valid	{user:'admin'}	Access granted
9	User sends request without valid session	No or invalid cookie	{}	Pending
10	Deny access	Session invalid	{}	401 Unauthorized

💡 Execution stops when server grants or denies access based on session validity.

Variable Tracker

Variable	Start	After Step 4	After Step 6	Final
req.session	{}	{user:'admin'}	{user:'admin'}	{} or {user:'admin'} depending on request
Response	None	Pending	Pending	'Logged in' or '401 Unauthorized'

Key Moments - 3 Insights

Why does the server store user info in req.session instead of sending it back directly?

Storing user info in req.session keeps the user logged in across requests without resending credentials. See execution_table step 4 where session is created and step 6 where session is checked.

What happens if the user sends a request without the session cookie?

The server cannot find a valid session and denies access, as shown in execution_table steps 9 and 10.

How does the server know which session belongs to which user?

The server uses the session ID stored in the cookie sent by the user. This ID links to the session data on the server, as shown in execution_table step 7.

Visual Quiz - 3 Questions

Look at the execution table, what is the session state after step 4?

A {user:'admin'}

B null

C {}

D {user:'guest'}

💡 Hint

Check the 'Session State' column at step 4 in the execution_table.

At which step does the server deny access due to invalid session?

A Step 6

B Step 10

C Step 7

D Step 8

💡 Hint

Look for '401 Unauthorized' in the 'Response' column in execution_table.

If the user sends a request without valid session, which step shows the server response?

A Step 5

B Step 3

C Step 10

D Step 2

💡 Hint

Check where the server sends '401 Unauthorized' response in execution_table.

Concept Snapshot

Session-based authentication in NestJS:
- User sends login with credentials
- Server verifies credentials
- If valid, server creates session and stores user info
- Session ID sent in cookie to client
- Client sends cookie with each request
- Server checks session ID to allow or deny access
- Sessions keep user logged in without resending password

Full Transcript

Session-based authentication in NestJS works by the user sending a login request with credentials. The server checks these credentials. If they are correct, the server creates a session and stores user information in it. The server sends a session ID back to the user in a cookie. For every following request, the user sends this cookie. The server uses the session ID from the cookie to find the session data and verify the user is logged in. If the session is valid, the server grants access. If not, it denies access. This way, the user stays logged in without sending the password every time.

Practice

1. What is the main purpose of session-based authentication in NestJS?

easy

A. To keep user login information on the server for tracking user sessions

B. To store user passwords in the browser for quick access

C. To send user credentials with every request without storing them

D. To use tokens stored in local storage for authentication

Solution

1. Step 1: Understand session-based authentication

   Session-based authentication stores user info on the server to track login status across requests.

2. Step 2: Compare options with session concept

   Only To keep user login information on the server for tracking user sessions describes storing user login info on the server, which matches session-based authentication.

3. Final Answer:

   To keep user login information on the server for tracking user sessions -> Option A

4. Quick Check:

   Session stores user info on server = C [OK]

Hint: Sessions store user info on server, not client [OK]

Common Mistakes:

• Confusing sessions with token storage
• Thinking sessions store passwords in browser
• Believing credentials are sent every request without storage

2. Which of the following is the correct way to import session support in a NestJS module?

easy

A. import { SessionModule } from '@nestjs/session';

B. import { SessionModule } from '@nestjs/common';

C. import { SessionModule } from 'express-session';

D. import { SessionModule } from 'nestjs-session';

Solution

1. Step 1: Identify correct package for session in NestJS

   The official session support in NestJS is provided by '@nestjs/session'.

2. Step 2: Check import statements

   Only import { SessionModule } from '@nestjs/session'; imports SessionModule from '@nestjs/session', which is correct syntax.

3. Final Answer:

   import { SessionModule } from '@nestjs/session'; -> Option A

4. Quick Check:

   SessionModule from '@nestjs/session' = D [OK]

Hint: SessionModule comes from '@nestjs/session' package [OK]

Common Mistakes:

• Importing SessionModule from '@nestjs/common'
• Confusing express-session with NestJS module import
• Using incorrect package names

3. Given this NestJS controller snippet, what will be the output when a logged-in user accesses /profile?

import { Controller, Get, Req } from '@nestjs/common';

@Controller()
export class AppController {
  @Get('profile')
  getProfile(@Req() req) {
    if (req.session.user) {
      return `Hello, ${req.session.user.name}`;
    } else {
      return 'Not logged in';
    }
  }
}

medium

A. "Hello, undefined" if user exists but name is missing

B. "Not logged in" always

C. Throws an error because req.session is undefined

D. "Hello, Alice" if req.session.user.name is 'Alice'

Solution

1. Step 1: Check session user existence

   The code checks if req.session.user exists to decide output.

2. Step 2: Understand output when user exists

   If user exists with name 'Alice', it returns "Hello, Alice" string.

3. Final Answer:

   "Hello, Alice" if req.session.user.name is 'Alice' -> Option D

4. Quick Check:

   Session user present returns greeting = A [OK]

Hint: If session user exists, greet by name; else say not logged in [OK]

Common Mistakes:

• Assuming req.session is always undefined
• Ignoring the user existence check
• Confusing output strings

4. Identify the error in this NestJS session setup code:

import { Module } from '@nestjs/common';
import { SessionModule } from '@nestjs/session';

@Module({
  imports: [
    SessionModule.forRoot({
      secret: 'mySecret',
      resave: false,
      saveUninitialized: true,
    }),
  ],
})
export class AppModule {}

medium

A. Missing 'cookie' configuration inside forRoot options

B. The secret should be an environment variable, not a string literal

C. 'resave' and 'saveUninitialized' are not valid options for SessionModule

D. SessionModule.forRoot should be replaced with SessionModule.register

Solution

1. Step 1: Review SessionModule options

   In '@nestjs/session', options like 'resave' and 'saveUninitialized' are not valid; they belong to express-session directly.

2. Step 2: Identify correct option usage

   SessionModule expects options like 'secret' and 'cookie', but not 'resave' or 'saveUninitialized'.

3. Final Answer:

   'resave' and 'saveUninitialized' are not valid options for SessionModule -> Option C

4. Quick Check:

   Invalid options in SessionModule config = B [OK]

Hint: Check if options belong to NestJS SessionModule or express-session [OK]

Common Mistakes:

• Adding express-session options directly to SessionModule
• Confusing 'forRoot' with 'register'
• Ignoring required cookie config

5. You want to protect a NestJS route so only logged-in users with a session can access it. Which approach correctly checks the session and denies access if no user is logged in?

import { Controller, Get, Req, Res } from '@nestjs/common';
import { Response, Request } from 'express';

@Controller()
export class AppController {
  @Get('dashboard')
  dashboard(@Req() req: Request, @Res() res: Response) {
    // What should go here?
  }
}

hard

A. if (req.session.user === undefined) { throw new Error('No session'); } return 'Welcome';

B. if (!req.session.user) { return res.status(401).send('Unauthorized'); } return res.send('Welcome ' + req.session.user.name);

C. if (!req.session) { return 'Please login'; } return 'Dashboard';

D. if (req.session.user) { return 'Unauthorized'; } else { return 'Welcome'; }

Solution

1. Step 1: Check if user is logged in via session

   We verify if req.session.user exists; if not, deny access with 401 status.

2. Step 2: Return welcome message if user exists

   If user exists, send a welcome message with their name.

3. Final Answer:

   if (!req.session.user) { return res.status(401).send('Unauthorized'); } return res.send('Welcome ' + req.session.user.name); -> Option B

4. Quick Check:

   Check session user, deny if missing = A [OK]

Hint: Return 401 if no session user, else welcome [OK]

Common Mistakes:

• Throwing errors instead of sending HTTP response
• Checking only if req.session exists, not user
• Reversing logic for authorization