Session-based authentication in NestJS - Step-by-Step Execution

Concept Flow - Session-based authentication

User sends login request

↓

Server verifies credentials

Yes↓

Server creates session

↓

Session ID stored in cookie

↓

User sends requests with cookie

↓

Server checks session ID

↓

Server grants access

↓

End

No↓

Server denies access

↓

End

User logs in, server checks credentials, creates a session, stores session ID in cookie, then checks session on each request to allow or deny access.

Execution Sample

NestJS

import { Controller, Post, Req, Res } from '@nestjs/common';
import * as session from 'express-session';

@Controller('auth')
export class AuthController {
  @Post('login')
  login(@Req() req, @Res() res) {
    if (req.body.user === 'admin' && req.body.pass === '123') {
      req.session.user = 'admin';
      res.send('Logged in');
    } else {
      res.status(401).send('Unauthorized');
    }
  }
}

This code checks user credentials, creates a session if valid, and sends a response.

Execution Table

Step	Action	Input	Session State	Response
1	User sends login request	{user:'admin', pass:'123'}	{}	Pending
2	Server checks credentials	user='admin', pass='123'	{}	Pending
3	Credentials valid?	Yes	{}	Pending
4	Create session	Set req.session.user='admin'	{user:'admin'}	Pending
5	Send response	Session created	{user:'admin'}	'Logged in' with Set-Cookie
6	User sends request with cookie	Cookie with session ID	{user:'admin'}	Pending
7	Server checks session ID	Session ID valid	{user:'admin'}	Pending
8	Grant access	Session valid	{user:'admin'}	Access granted
9	User sends request without valid session	No or invalid cookie	{}	Pending
10	Deny access	Session invalid	{}	401 Unauthorized

💡 Execution stops when server grants or denies access based on session validity.

Variable Tracker

Variable	Start	After Step 4	After Step 6	Final
req.session	{}	{user:'admin'}	{user:'admin'}	{} or {user:'admin'} depending on request
Response	None	Pending	Pending	'Logged in' or '401 Unauthorized'

Key Moments - 3 Insights

Why does the server store user info in req.session instead of sending it back directly?

Storing user info in req.session keeps the user logged in across requests without resending credentials. See execution_table step 4 where session is created and step 6 where session is checked.

What happens if the user sends a request without the session cookie?

The server cannot find a valid session and denies access, as shown in execution_table steps 9 and 10.

How does the server know which session belongs to which user?

The server uses the session ID stored in the cookie sent by the user. This ID links to the session data on the server, as shown in execution_table step 7.

Visual Quiz - 3 Questions

Look at the execution table, what is the session state after step 4?

A {user:'admin'}

B null

C {}

D {user:'guest'}

💡 Hint

Check the 'Session State' column at step 4 in the execution_table.

At which step does the server deny access due to invalid session?

A Step 6

B Step 10

C Step 7

D Step 8

💡 Hint

Look for '401 Unauthorized' in the 'Response' column in execution_table.

If the user sends a request without valid session, which step shows the server response?

A Step 5

B Step 3

C Step 10

D Step 2

💡 Hint

Check where the server sends '401 Unauthorized' response in execution_table.

Concept Snapshot

Session-based authentication in NestJS:
- User sends login with credentials
- Server verifies credentials
- If valid, server creates session and stores user info
- Session ID sent in cookie to client
- Client sends cookie with each request
- Server checks session ID to allow or deny access
- Sessions keep user logged in without resending password

Full Transcript

Session-based authentication in NestJS works by the user sending a login request with credentials. The server checks these credentials. If they are correct, the server creates a session and stores user information in it. The server sends a session ID back to the user in a cookie. For every following request, the user sends this cookie. The server uses the session ID from the cookie to find the session data and verify the user is logged in. If the session is valid, the server grants access. If not, it denies access. This way, the user stays logged in without sending the password every time.