Token generation and validation in NestJS - Performance & Optimization

Performance: Token generation and validation

MEDIUM IMPACT

This affects page load speed and interaction responsiveness by controlling how quickly tokens are generated and validated during user authentication.

Generating and validating JWT tokens for user authentication

NestJS

import { Injectable } from '@nestjs/common';
import { JwtService } from '@nestjs/jwt';

@Injectable()
export class AuthService {
  constructor(private jwtService: JwtService) {}

  async generateToken(user: any) {
    return await this.jwtService.signAsync(user, { expiresIn: '1h' });
  }

  async validateToken(token: string) {
    try {
      return await this.jwtService.verifyAsync(token);
    } catch {
      return null;
    }
  }
}

Using asynchronous token methods prevents blocking, allowing other requests to be processed concurrently.

📈 Performance GainNon-blocking token operations reduce response latency and improve throughput under load

Generating and validating JWT tokens for user authentication

NestJS

import * as jwt from 'jsonwebtoken';

function generateToken(user) {
  return jwt.sign(user, 'secretKey', { expiresIn: '1h' });
}

function validateToken(token) {
  try {
    return jwt.verify(token, 'secretKey');
  } catch (e) {
    return null;
  }
}

Using synchronous token generation and validation blocks the event loop, causing slower response times under load.

📉 Performance CostBlocks event loop during token operations, increasing response latency by 50-100ms per request

Performance Comparison

Pattern	DOM Operations	Reflows	Paint Cost	Verdict
Synchronous token generation/validation	0 (server-side)	0	0	[X] Bad
Asynchronous token generation/validation	0 (server-side)	0	0	[OK] Good

Rendering Pipeline

Token generation and validation happen on the server side before the response is sent. Efficient async handling ensures the server can quickly process authentication without delaying the response.

→Server Processing

→Network Response

⚠️ BottleneckServer Processing during synchronous token operations

Core Web Vital Affected

INP

This affects page load speed and interaction responsiveness by controlling how quickly tokens are generated and validated during user authentication.

Optimization Tips

1Always use asynchronous methods for token generation and validation to avoid blocking the server.

2Cache token verification results when possible to reduce repeated computation.

3Keep token payloads small to minimize processing time and network transfer.

Performance Quiz - 3 Questions

What is the main performance benefit of using asynchronous token generation in NestJS?

A It automatically caches tokens on the client.

B It prevents blocking the event loop, improving server responsiveness.

C It reduces the size of the token payload.

D It increases token expiration time.

DevTools: Network

How to check: Open DevTools, go to Network tab, filter requests to authentication endpoints, and check response times.

What to look for: Look for lower server response times indicating faster token processing.

Practice

1. What is the main purpose of generating a token in a NestJS application?

easy

A. To prove a user's identity without sharing their password

B. To store user passwords securely

C. To encrypt the entire database

D. To create a backup of user data

Solution

1. Step 1: Understand token purpose

   Tokens are used to prove who a user is without sharing sensitive information like passwords.

2. Step 2: Compare options

   Only To prove a user's identity without sharing their password correctly describes token use; others describe unrelated tasks.

3. Final Answer:

   To prove a user's identity without sharing their password -> Option A

4. Quick Check:

   Token purpose = Identity proof without password [OK]

Hint: Tokens prove identity safely without passwords [OK]

Common Mistakes:

• Thinking tokens store passwords
• Confusing tokens with database encryption
• Assuming tokens backup data

2. Which of the following is the correct way to generate a JWT token using the jsonwebtoken package in NestJS?

easy

A. jwt.sign(payload, secretKey, { expiresIn: '1h' })

B. jwt.create(payload, secretKey)

C. jwt.generateToken(secretKey, payload)

D. jwt.verify(payload, secretKey)

Solution

1. Step 1: Recall JWT token creation syntax

   The sign method creates a token with payload, secret key, and options.

2. Step 2: Check options

   Only jwt.sign(payload, secretKey, { expiresIn: '1h' }) uses sign correctly with payload, secret, and expiration.

3. Final Answer:

   jwt.sign(payload, secretKey, { expiresIn: '1h' }) -> Option A

4. Quick Check:

   Token creation uses sign() method [OK]

Hint: Use jwt.sign() to create tokens with payload and secret [OK]

Common Mistakes:

• Using jwt.create() which does not exist
• Mixing order of arguments
• Using jwt.verify() to create tokens

3. Given the following code snippet in a NestJS service, what will be the output if the token is valid?

const token = jwt.sign({ userId: 123 }, 'secretKey', { expiresIn: '1h' });
const decoded = jwt.verify(token, 'secretKey');
console.log(decoded.userId);

medium

A. undefined

B. null

C. 123

D. Throws an error

Solution

1. Step 1: Understand token creation and verification

   The token is created with payload { userId: 123 } and signed with 'secretKey'.

2. Step 2: Verify token with the same secret

   Verification returns the decoded payload, so decoded.userId is 123.

3. Final Answer:

   123 -> Option C

4. Quick Check:

   Valid token returns payload userId = 123 [OK]

Hint: Verify returns original payload if token and secret match [OK]

Common Mistakes:

• Expecting undefined or null instead of payload
• Using wrong secret causing error
• Confusing verify with sign

4. Identify the error in this NestJS token validation code:

try {
  const payload = jwt.verify(token, secret);
  return payload.userId;
} catch (error) {
  return 'Invalid token';
}

medium

A. Secret key is not defined

B. Missing async keyword for jwt.verify

C. jwt.verify should be jwt.sign

D. No error, code works correctly

Solution

1. Step 1: Analyze jwt.verify usage

   jwt.verify is synchronous and used correctly inside try-catch to handle errors.

2. Step 2: Check for missing elements

   Assuming secret and token are defined, no syntax or logic errors exist.

3. Final Answer:

   No error, code works correctly -> Option D

4. Quick Check:

   jwt.verify with try-catch is correct pattern [OK]

Hint: jwt.verify is synchronous; use try-catch for errors [OK]

Common Mistakes:

• Thinking jwt.verify is async
• Confusing verify with sign
• Assuming secret is undefined without context

5. You want to generate a JWT token in NestJS that expires in 30 minutes and includes the user's email and role. Which code snippet correctly achieves this?

hard

A. jwt.sign({ email, role }, secretKey, { expiresAt: '30m' })

B. jwt.sign({ email, role }, secretKey, { expiresIn: '30m' })

C. jwt.sign({ email, role }, secretKey, { expiration: 1800 })

D. jwt.sign({ email, role }, secretKey, { expireIn: 30 })

Solution

1. Step 1: Recall correct expiration option for jwt.sign

   The option to set token lifetime is expiresIn with string or number format.

2. Step 2: Validate option values

   Only jwt.sign({ email, role }, secretKey, { expiresIn: '30m' }) uses expiresIn: '30m' correctly; others use invalid keys or formats.

3. Final Answer:

   jwt.sign({ email, role }, secretKey, { expiresIn: '30m' }) -> Option B

4. Quick Check:

   Use expiresIn with '30m' for 30 minutes expiry [OK]

Hint: Use expiresIn: '30m' to set 30-minute token expiry [OK]

Common Mistakes:

• Using expiresAt or expiration instead of expiresIn
• Passing number without units as string
• Misspelling expiresIn option