Question 1

Passport in Nest — typical pattern?

Accepted Answer

AuthModule with PassportStrategy providers, AuthGuard('jwt'|'local'), and strategies encapsulating validation. Keep strategies thin; issue tokens in auth service. Prefer cookie or bearer consistently.

Question 2

JWT AuthGuard flow in Nest?

Accepted Answer

Extract bearer token, verify signature/claims via strategy, attach user to request. Handle expiration and clock skew. Use JWKS for asymmetric keys. Don't trust unverified payloads.

Question 3

How do you implement refresh tokens with Nest?

Accepted Answer

Store hashed refresh tokens, rotate on use, protect refresh route, and short-lived access JWTs. Reuse detection revokes families. Separate secrets. Prefer httpOnly cookies for browsers.

Question 4

Global AuthGuard with public routes — pattern?

Accepted Answer

APP_GUARD with Reflector checking @Public() metadata to skip auth. E2e test both public and protected. Don't rely on omission of guards alone in large apps.

Question 5

Session-based auth with Nest — considerations?

Accepted Answer

express-session/fastify session store (Redis), CSRF for cookie auth, and secure cookie flags. Stateless JWT vs sessions trade-offs still apply. Sticky sessions without external store don't scale.

Question 6

Lead: integrate Nest services with corporate OIDC/SSO.

Accepted Answer

OIDC authorization code at BFF/gateway, validate JWTs with JWKS cache, map claims to internal principals. Centralize claim-to-role mapping. Plan key rotation. Audit login events.

Authentication NestJS Interview Questions

Other NestJS interview topics