Why authentication secures NestJS APIs - Challenge Your Understanding

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is the primary role of authentication in NestJS APIs?

Authentication in NestJS APIs is mainly used to:

A Encrypt all data sent between client and server

B Automatically log all user actions in the API

C Verify the identity of users before granting access to API resources

D Optimize API response times by caching user data

💡 Hint

Think about what authentication means in everyday life, like showing an ID to prove who you are.

Authentication confirms who the user is. In NestJS APIs, it ensures only verified users can access protected routes.

❓ component_behavior

intermediate

What happens when a NestJS API receives a request without valid authentication?

If a request to a protected NestJS API route lacks valid authentication, the API will:

A Process the request normally without restrictions

B Return a 401 Unauthorized error and deny access

C Redirect the user to the homepage

D Log the user in automatically with default credentials

💡 Hint

Think about what should happen if someone tries to enter a locked door without a key.

Without valid authentication, NestJS APIs respond with a 401 error to prevent unauthorized access.

❓ state_output

advanced

What is the output of this NestJS guard when authentication fails?

Consider this simplified NestJS guard code snippet that checks authentication:

canActivate(context: ExecutionContext): boolean {
  const request = context.switchToHttp().getRequest();
  if (!request.user) {
    throw new UnauthorizedException('User not authenticated');
  }
  return true;
}

What will the API respond with if the request has no user?

NestJS

canActivate(context: ExecutionContext): boolean {
  const request = context.switchToHttp().getRequest();
  if (!request.user) {
    throw new UnauthorizedException('User not authenticated');
  }
  return true;
}

A HTTP 401 Unauthorized with message 'User not authenticated'

B HTTP 403 Forbidden with message 'Access denied'

C HTTP 200 OK with empty response

D HTTP 500 Internal Server Error

💡 Hint

UnauthorizedException in NestJS sends a 401 status code.

The guard throws an UnauthorizedException which results in a 401 response with the given message.

📝 Syntax

advanced

Which code snippet correctly applies authentication guard to a NestJS controller route?

You want to protect a NestJS controller route so only authenticated users can access it. Which code correctly applies the AuthGuard?

A

@UseGuards(AuthGuard('jwt'))
@Get('profile')
getProfile() {
  return 'User profile';
}

B

@UseGuards('jwt')
@Get('profile')
getProfile() {
  return 'User profile';
}

C

@UseGuards(AuthGuard)
@Get('profile')
getProfile() {
  return 'User profile';
}

D

@UseGuards(AuthGuard('local'))
@Get('profile')
getProfile() {
  return 'User profile';
}

💡 Hint

AuthGuard needs the strategy name as a string argument inside parentheses.

Option A correctly uses AuthGuard with the 'jwt' strategy to protect the route.

Option A is missing the AuthGuard function call.

Option A lacks the strategy name.

Option A uses 'local' strategy which is not for JWT authentication.

🔧 Debug

expert

Why does this NestJS API allow access without authentication despite using AuthGuard?

Given this NestJS controller code:

@Controller('data')
export class DataController {
  @Get()
  @UseGuards(AuthGuard('jwt'))
  getData() {
    return 'Protected data';
  }

  @Get('public')
  getPublicData() {
    return 'Public data';
  }
}

A user can access the 'getData' route without a token. What is the most likely reason?

NestJS

@Controller('data')
export class DataController {
  @Get()
  @UseGuards(AuthGuard('jwt'))
  getData() {
    return 'Protected data';
  }

  @Get('public')
  getPublicData() {
    return 'Public data';
  }
}

A The JWT strategy is incorrectly named and does not match the guard argument

B The 'getData' method is missing the @UseGuards decorator

C The controller is missing the @UseGuards decorator at the class level

D The AuthGuard is not registered globally or in the module, so it does not enforce authentication

💡 Hint

Guards must be properly registered and the strategy must be configured in the module.

If the AuthGuard is not properly registered or the JWT strategy is not configured, the guard will not block unauthenticated requests even if used.

Practice

1. Why is authentication important for securing NestJS APIs?

easy

A. It stops strangers from accessing protected routes.

B. It speeds up the API response time.

C. It automatically fixes bugs in the code.

D. It changes the API's data format.

Solution

1. Step 1: Understand the purpose of authentication

   Authentication verifies who is using the API to prevent unauthorized access.

2. Step 2: Identify the effect on API security

   By stopping strangers, authentication protects sensitive data and functionality.

3. Final Answer:

   It stops strangers from accessing protected routes. -> Option A

4. Quick Check:

   Authentication = Stops strangers [OK]

Hint: Authentication blocks unknown users from API access [OK]

Common Mistakes:

• Thinking authentication speeds up API
• Believing it fixes code bugs
• Confusing authentication with data formatting

2. Which of the following is the correct way to apply an authentication guard in a NestJS controller?

easy

A. @AuthGuard('jwt') export class MyController {}

B. @UseGuards(AuthGuard('jwt')) export class MyController {}

C. @UseAuthGuard('jwt') export class MyController {}

D. @GuardUse(Auth('jwt')) export class MyController {}

Solution

1. Step 1: Recall NestJS guard syntax

   Guards are applied using the @UseGuards() decorator with the guard class or strategy inside.

2. Step 2: Match the correct syntax for JWT guard

   The correct syntax is @UseGuards(AuthGuard('jwt')) to apply the JWT strategy.

3. Final Answer:

   @UseGuards(AuthGuard('jwt')) export class MyController {} -> Option B

4. Quick Check:

   @UseGuards(AuthGuard('jwt')) = Correct syntax [OK]

Hint: Use @UseGuards with AuthGuard('jwt') for authentication [OK]

Common Mistakes:

• Using wrong decorator names like @AuthGuard
• Swapping order of decorator and parameters
• Misspelling @UseGuards

3. Given this NestJS controller snippet, what happens when a request without a valid JWT token is sent?

@UseGuards(AuthGuard('jwt'))
@Get('profile')
getProfile() {
  return { message: 'Access granted' };
}

medium

A. The request is denied with a 401 Unauthorized error.

B. The request returns an empty response.

C. The request causes a server crash.

D. The request is allowed and returns { message: 'Access granted' }.

Solution

1. Step 1: Understand AuthGuard('jwt') behavior

   This guard checks for a valid JWT token and blocks requests without it.

2. Step 2: Predict response for missing or invalid token

   Without a valid token, the guard denies access and returns a 401 Unauthorized error.

3. Final Answer:

   The request is denied with a 401 Unauthorized error. -> Option A

4. Quick Check:

   Invalid token = 401 error [OK]

Hint: No valid JWT means 401 Unauthorized response [OK]

Common Mistakes:

• Assuming request passes without token
• Expecting server crash on missing token
• Thinking empty response is returned

4. Identify the error in this NestJS authentication guard usage:

@UseGuards(AuthGuard)
@Get('data')
getData() {
  return { data: 'secret' };
}

medium

A. The @UseGuards decorator is misspelled.

B. The getData method should be async.

C. AuthGuard is missing the strategy name like 'jwt'.

D. The route path 'data' is invalid.

Solution

1. Step 1: Check AuthGuard usage

   AuthGuard requires a strategy name like 'jwt' to know which authentication method to use.

2. Step 2: Identify missing strategy parameter

   Here, AuthGuard is used without ('jwt'), causing it to not work properly.

3. Final Answer:

   AuthGuard is missing the strategy name like 'jwt'. -> Option C

4. Quick Check:

   AuthGuard needs strategy name [OK]

Hint: Always provide strategy name to AuthGuard like 'jwt' [OK]

Common Mistakes:

• Forgetting to add strategy name to AuthGuard
• Thinking method must be async
• Assuming route path 'data' is invalid

5. You want to secure a NestJS API route so only logged-in users can access it. Which combination correctly applies authentication and explains why it secures the API? Options: A) Use @UseGuards(AuthGuard('jwt')) to check user identity before route access, preventing strangers. B) Use @UseInterceptors(AuthInterceptor) to log requests, which blocks unauthorized users. C) Use @UseFilters(AuthFilter) to catch errors, which stops unauthorized access. D) Use @UsePipes(AuthPipe) to validate data, which ensures only valid users access the route.

hard

A. Use @UsePipes(AuthPipe) to validate data, which ensures only valid users access the route.

B. Use @UseInterceptors(AuthInterceptor) to log requests, which blocks unauthorized users.

C. Use @UseFilters(AuthFilter) to catch errors, which stops unauthorized access.

D. Use @UseGuards(AuthGuard('jwt')) to check user identity before route access, preventing strangers.

Solution

1. Step 1: Identify the correct NestJS feature for authentication

   Guards are designed to control access by checking user identity before route execution.

2. Step 2: Understand why guards secure APIs

   Using @UseGuards(AuthGuard('jwt')) ensures only authenticated users with valid JWT tokens can access the route, blocking strangers.

3. Final Answer:

   Use @UseGuards(AuthGuard('jwt')) to check user identity before route access, preventing strangers. -> Option D

4. Quick Check:

   Guards + AuthGuard('jwt') = Secure API access [OK]

Hint: Use guards with AuthGuard('jwt') to secure routes [OK]

Common Mistakes:

• Confusing interceptors, filters, or pipes with authentication guards
• Thinking logging or error handling blocks unauthorized users
• Assuming data validation equals authentication