Token generation and validation in NestJS - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of token generation in NestJS?

Token generation creates a secure string (token) that represents a user's identity. It helps the server recognize and authorize users without needing to store session data.

beginner

Which NestJS package is commonly used for JWT token generation and validation?

The @nestjs/jwt package is commonly used to generate and validate JSON Web Tokens (JWT) in NestJS applications.

intermediate

What is the role of a secret key in token generation and validation?

The secret key signs the token to ensure it is authentic. During validation, the server uses the same secret to verify the token was not changed or forged.

intermediate

How does token validation work in NestJS?

Token validation checks if the token is correctly signed and not expired. If valid, it extracts user info from the token to allow access to protected routes.

intermediate

What is the difference between access tokens and refresh tokens?

Access tokens are short-lived tokens used to access resources. Refresh tokens last longer and are used to get new access tokens without logging in again.

Which method from @nestjs/jwt is used to create a token?

A sign()

B verify()

C decode()

D encrypt()

The sign() method creates a JWT token by encoding the payload with a secret.

What happens if a token is expired during validation?

A User is logged out immediately

B Token is accepted anyway

C Token is refreshed automatically

D Validation fails and access is denied

Expired tokens fail validation, so access to protected resources is denied.

Which NestJS feature helps protect routes using token validation?

A Pipes

B Guards

C Interceptors

D Filters

Guards check requests before they reach route handlers, often used for token validation.

What is stored inside a JWT token?

A User data payload

B User password

C Server secret key

D Database connection string

JWT tokens contain a payload with user data like ID or roles, but never sensitive info like passwords.

Why use refresh tokens alongside access tokens?

A To speed up login

B To avoid storing user data

C To renew access tokens without re-login

D To encrypt user passwords

Refresh tokens allow users to get new access tokens without logging in again, improving user experience.

Explain how token generation and validation work together in a NestJS authentication flow.

Think about how the server and client share and check the token.

Describe the difference between access tokens and refresh tokens and why both are used.

Consider token lifetime and user convenience.