Why authentication secures NestJS APIs - Challenge Your Understanding

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is the primary role of authentication in NestJS APIs?

Authentication in NestJS APIs is mainly used to:

A Encrypt all data sent between client and server

B Automatically log all user actions in the API

C Verify the identity of users before granting access to API resources

D Optimize API response times by caching user data

💡 Hint

Think about what authentication means in everyday life, like showing an ID to prove who you are.

Authentication confirms who the user is. In NestJS APIs, it ensures only verified users can access protected routes.

❓ component_behavior

intermediate

What happens when a NestJS API receives a request without valid authentication?

If a request to a protected NestJS API route lacks valid authentication, the API will:

A Process the request normally without restrictions

B Return a 401 Unauthorized error and deny access

C Redirect the user to the homepage

D Log the user in automatically with default credentials

💡 Hint

Think about what should happen if someone tries to enter a locked door without a key.

Without valid authentication, NestJS APIs respond with a 401 error to prevent unauthorized access.

❓ state_output

advanced

What is the output of this NestJS guard when authentication fails?

Consider this simplified NestJS guard code snippet that checks authentication:

canActivate(context: ExecutionContext): boolean {
  const request = context.switchToHttp().getRequest();
  if (!request.user) {
    throw new UnauthorizedException('User not authenticated');
  }
  return true;
}

What will the API respond with if the request has no user?

NestJS

canActivate(context: ExecutionContext): boolean {
  const request = context.switchToHttp().getRequest();
  if (!request.user) {
    throw new UnauthorizedException('User not authenticated');
  }
  return true;
}

A HTTP 401 Unauthorized with message 'User not authenticated'

B HTTP 403 Forbidden with message 'Access denied'

C HTTP 200 OK with empty response

D HTTP 500 Internal Server Error

💡 Hint

UnauthorizedException in NestJS sends a 401 status code.

The guard throws an UnauthorizedException which results in a 401 response with the given message.

📝 Syntax

advanced

Which code snippet correctly applies authentication guard to a NestJS controller route?

You want to protect a NestJS controller route so only authenticated users can access it. Which code correctly applies the AuthGuard?

A

@UseGuards(AuthGuard('jwt'))
@Get('profile')
getProfile() {
  return 'User profile';
}

B

@UseGuards('jwt')
@Get('profile')
getProfile() {
  return 'User profile';
}

C

@UseGuards(AuthGuard)
@Get('profile')
getProfile() {
  return 'User profile';
}

D

@UseGuards(AuthGuard('local'))
@Get('profile')
getProfile() {
  return 'User profile';
}

💡 Hint

AuthGuard needs the strategy name as a string argument inside parentheses.

Option A correctly uses AuthGuard with the 'jwt' strategy to protect the route.

Option A is missing the AuthGuard function call.

Option A lacks the strategy name.

Option A uses 'local' strategy which is not for JWT authentication.

🔧 Debug

expert

Why does this NestJS API allow access without authentication despite using AuthGuard?

Given this NestJS controller code:

@Controller('data')
export class DataController {
  @Get()
  @UseGuards(AuthGuard('jwt'))
  getData() {
    return 'Protected data';
  }

  @Get('public')
  getPublicData() {
    return 'Public data';
  }
}

A user can access the 'getData' route without a token. What is the most likely reason?

NestJS

@Controller('data')
export class DataController {
  @Get()
  @UseGuards(AuthGuard('jwt'))
  getData() {
    return 'Protected data';
  }

  @Get('public')
  getPublicData() {
    return 'Public data';
  }
}

A The JWT strategy is incorrectly named and does not match the guard argument

B The 'getData' method is missing the @UseGuards decorator

C The controller is missing the @UseGuards decorator at the class level

D The AuthGuard is not registered globally or in the module, so it does not enforce authentication

💡 Hint

Guards must be properly registered and the strategy must be configured in the module.

If the AuthGuard is not properly registered or the JWT strategy is not configured, the guard will not block unauthenticated requests even if used.