Question 1

Authentication vs authorization in Nest?

Accepted Answer

Authn: who is the user; authz: what they may do — guards/policies after identity is known. Never equate logged-in with allowed. Check resource ownership server-side.

Question 2

RBAC with roles metadata — limitations?

Accepted Answer

Roles are coarse; resource ownership and attributes need more than @Roles('admin'). Combine roles with resource checks in services/policies. Multi-tenant apps need tenant-scoped authz.

Question 3

How do you authorize user can edit own post?

Accepted Answer

Load resource, compare ownerId to user.id (or policy check), throw Forbidden if mismatch. Don't trust client-provided ownerId. Prefer ID from route plus server lookup. Guards can pre-check with Param.

Question 4

CASL or policy-based auth in Nest — why?

Accepted Answer

Express abilities as rules tested in one place; UI and API can share vocabulary. Guards invoke abilities. Keep rule definitions versioned. Test policies thoroughly.

Question 5

Debugging: authorized in UI but 403 from API.

Accepted Answer

Divergent rule implementations, stale claims, or missing tenant context on server. Single source of truth for policies. Log deny reasons centrally (carefully).

Question 6

Lead: multi-tenant authorization architecture for Nest?

Accepted Answer

Tenant context in ALS/JWT claims, row-level filters enforced in repos, and automated tests for cross-tenant access. Assume IDOR attempts. Pentest tenancy. Deny by default.

Authorization NestJS Interview Questions

Other NestJS interview topics