nestjs-authentication

JWT authentication in NestJS uses @nestjs/jwt and passport-jwt to create stateless API token verification. Implement a login endpoint that issues access tokens, apply JWT guards to protected routes, and configure the JwtStrategy to validate incoming tokens automatically.

Role-based access control uses guards and decorators to enforce permissions at the route or controller level. Define roles in your user entity, create custom guards that check user roles, and apply decorators to restrict endpoints so only authorized users can access them.

Build an auth module with endpoints for signup (validate and hash passwords, store users), login (verify credentials, issue JWT tokens), and logout (if using refresh tokens, invalidate them). Integrate with UsersService and apply password hashing for security.

Yes, refresh tokens extend session lifetime without re-authentication. Issue a short-lived access token and longer-lived refresh token on login, store refresh tokens securely, and create an endpoint that exchanges a valid refresh token for a new access token.

External providers are optional; NestJS supports both built-in local authentication (username/password) and integration with OAuth2 or SAML providers via Passport strategies. Choose based on your security requirements and user management needs.

Store tokens in secure, httpOnly cookies when possible to prevent XSS attacks. Use strong secrets for signing, set short expiration times for access tokens, validate token signatures server-side, and never expose secrets in client-side code or version control.