Token generation and validation in NestJS

Introduction

Tokens help keep users safe by proving who they are without sharing passwords. They let apps check if someone is allowed to do things.

When users log in and you want to remember them safely.

When you need to protect parts of your app so only certain users can access.

When you want to check if a user's request is real and not from a stranger.

When you want to avoid asking for passwords every time a user does something.

When building APIs that need secure access control.

Syntax

NestJS

import { JwtService } from '@nestjs/jwt';

// To generate a token
const token = jwtService.sign(payload);

// To validate a token
const decoded = jwtService.verify(token);

The payload is the user data you want to include inside the token.

Use sign to create a token and verify to check if it is valid.

Examples

This creates a token with username and user ID inside.

NestJS

const payload = { username: 'alice', sub: 1 };
const token = jwtService.sign(payload);

This checks if the token is real and not expired. If not, it throws an error.

NestJS

try {
  const user = jwtService.verify(token);
  // token is valid
} catch (e) {
  // token is invalid or expired
}

Sample Program

This example shows a simple AuthService that creates a token with user info and checks if a token is valid. It prints the token string and the decoded user data.

NestJS

import { Injectable } from '@nestjs/common';
import { JwtService } from '@nestjs/jwt';

@Injectable()
export class AuthService {
  constructor(private readonly jwtService: JwtService) {}

  generateToken(user: { id: number; username: string }) {
    const payload = { username: user.username, sub: user.id };
    return this.jwtService.sign(payload);
  }

  validateToken(token: string) {
    try {
      return this.jwtService.verify(token);
    } catch {
      return null;
    }
  }
}

// Example usage:
const authService = new AuthService(new JwtService({ secret: 'mySecretKey' }));
const token = authService.generateToken({ id: 1, username: 'alice' });
const userData = authService.validateToken(token);
console.log(token);
console.log(userData);

Important Notes

Always keep your secret key safe and never share it publicly.

Tokens usually expire after some time for extra security.

Use try-catch when verifying tokens to handle invalid or expired tokens gracefully.

Summary

Tokens prove who a user is without sharing passwords.

Use sign to create and verify to check tokens.

Keep your secret key safe and handle errors when validating tokens.

Practice

1. What is the main purpose of generating a token in a NestJS application?

easy

A. To prove a user's identity without sharing their password

B. To store user passwords securely

C. To encrypt the entire database

D. To create a backup of user data

Solution

1. Step 1: Understand token purpose

   Tokens are used to prove who a user is without sharing sensitive information like passwords.

2. Step 2: Compare options

   Only To prove a user's identity without sharing their password correctly describes token use; others describe unrelated tasks.

3. Final Answer:

   To prove a user's identity without sharing their password -> Option A

4. Quick Check:

   Token purpose = Identity proof without password [OK]

Hint: Tokens prove identity safely without passwords [OK]

Common Mistakes:

• Thinking tokens store passwords
• Confusing tokens with database encryption
• Assuming tokens backup data

2. Which of the following is the correct way to generate a JWT token using the jsonwebtoken package in NestJS?

easy

A. jwt.sign(payload, secretKey, { expiresIn: '1h' })

B. jwt.create(payload, secretKey)

C. jwt.generateToken(secretKey, payload)

D. jwt.verify(payload, secretKey)

Solution

1. Step 1: Recall JWT token creation syntax

   The sign method creates a token with payload, secret key, and options.

2. Step 2: Check options

   Only jwt.sign(payload, secretKey, { expiresIn: '1h' }) uses sign correctly with payload, secret, and expiration.

3. Final Answer:

   jwt.sign(payload, secretKey, { expiresIn: '1h' }) -> Option A

4. Quick Check:

   Token creation uses sign() method [OK]

Hint: Use jwt.sign() to create tokens with payload and secret [OK]

Common Mistakes:

• Using jwt.create() which does not exist
• Mixing order of arguments
• Using jwt.verify() to create tokens

3. Given the following code snippet in a NestJS service, what will be the output if the token is valid?

const token = jwt.sign({ userId: 123 }, 'secretKey', { expiresIn: '1h' });
const decoded = jwt.verify(token, 'secretKey');
console.log(decoded.userId);

medium

A. undefined

B. null

C. 123

D. Throws an error

Solution

1. Step 1: Understand token creation and verification

   The token is created with payload { userId: 123 } and signed with 'secretKey'.

2. Step 2: Verify token with the same secret

   Verification returns the decoded payload, so decoded.userId is 123.

3. Final Answer:

   123 -> Option C

4. Quick Check:

   Valid token returns payload userId = 123 [OK]

Hint: Verify returns original payload if token and secret match [OK]

Common Mistakes:

• Expecting undefined or null instead of payload
• Using wrong secret causing error
• Confusing verify with sign

4. Identify the error in this NestJS token validation code:

try {
  const payload = jwt.verify(token, secret);
  return payload.userId;
} catch (error) {
  return 'Invalid token';
}

medium

A. Secret key is not defined

B. Missing async keyword for jwt.verify

C. jwt.verify should be jwt.sign

D. No error, code works correctly

Solution

1. Step 1: Analyze jwt.verify usage

   jwt.verify is synchronous and used correctly inside try-catch to handle errors.

2. Step 2: Check for missing elements

   Assuming secret and token are defined, no syntax or logic errors exist.

3. Final Answer:

   No error, code works correctly -> Option D

4. Quick Check:

   jwt.verify with try-catch is correct pattern [OK]

Hint: jwt.verify is synchronous; use try-catch for errors [OK]

Common Mistakes:

• Thinking jwt.verify is async
• Confusing verify with sign
• Assuming secret is undefined without context

5. You want to generate a JWT token in NestJS that expires in 30 minutes and includes the user's email and role. Which code snippet correctly achieves this?

hard

A. jwt.sign({ email, role }, secretKey, { expiresAt: '30m' })

B. jwt.sign({ email, role }, secretKey, { expiresIn: '30m' })

C. jwt.sign({ email, role }, secretKey, { expiration: 1800 })

D. jwt.sign({ email, role }, secretKey, { expireIn: 30 })

Solution

1. Step 1: Recall correct expiration option for jwt.sign

   The option to set token lifetime is expiresIn with string or number format.

2. Step 2: Validate option values

   Only jwt.sign({ email, role }, secretKey, { expiresIn: '30m' }) uses expiresIn: '30m' correctly; others use invalid keys or formats.

3. Final Answer:

   jwt.sign({ email, role }, secretKey, { expiresIn: '30m' }) -> Option B

4. Quick Check:

   Use expiresIn with '30m' for 30 minutes expiry [OK]

Hint: Use expiresIn: '30m' to set 30-minute token expiry [OK]

Common Mistakes:

• Using expiresAt or expiration instead of expiresIn
• Passing number without units as string
• Misspelling expiresIn option