![\"The](\"/75cf5afcae41ee6a1ea963da104389ff/console-received-chunk-of-size-x.gif\")
There are many use cases of a system where machine-to-machine (M2M) communication is required, or you need to manage access for internal and external APIs. The example of M2M communications are:
\nIn such cases, the generic authentication methods such as email/password and social login — requiring human intervention — don’t fit well. These interactions also need a secure and easy-to-use authorization process for permission-based data access.
\nM2M Authorization fulfills both these requirements. Let’s know more about what it is and how it works.
\nM2M Authorization is the process of providing remote systems with secure access to information. Using this process, business systems can communicate autonomously and execute business functions based on predefined authorization.
\nIt is exclusively used for scenarios in which a business system authenticates and authorizes a service rather than a user.
\nLoginRadius M2M Authorization uses the Client Credentials Grant Flow (defined in OAuth 2.0 RFC 6749), in which the client passes along secure credentials to authenticate themselves and receive an authorization token.
\nSuppose an organization has a microservices environment consisting of multiple services running locally. The organization also has data storage on a different network and requires:
\nAs a standard process and security measure, services require authorization while saving and reading the data to and from the storage. The organization can use LoginRadius for autonomous authorization by creating two dedicated M2M apps with write and read permissions.
\nThe following two scenarios explain how you can use LoginRadius M2M Authentication and Authorization to share permission-based access of APIs to any internal or external systems:
\n\n\nImportant: M2M App referred to in the scenarios below must be created individually for each internal or external system you want to grant access to. Upon app creation, you receive the Client Id and Client Secret.
\n
Scenario 1: To grant desired access to your LoginRadius Management APIs.
\nTo start using the M2M Authorization for this scenario, you need to create an M2M App and define the desired scope of API(s), as explained here.
\nThe client (partner, API, service, etc.) requests the access token using the following API:
\nAPI endpoint: https://api.loginradius.com/services/oauth/token
The following is an example request:
\nPOST https://<LoginRadiusAppName>.hub.loginradius.com/service/oauth/token\nContent-Type: application/json\n{\n "audience": "`https://api.loginradius.com/identity/v2/manage",`\n "grant_type": "client_credentials",\n "client_id": "<YOUR_CLIENT_ID>",\n "client_secret": "<YOUR_CLIENT_SECRET>"\n}LoginRadius Authorization Server validates the request. Upon validation, it returns the JWT access token to the client.
\nThe following is an example response with an access token:
\n{\n "access_token": "eyJz93a...k4laUWw",\n "token_type": "Bearer",\n "expires_in": 86400,\n}\n\nJWT Token Details\n{\n "iss": "https://<LoginRadiusAppName>.hub.loginradius.com/",\n "sub": "<OAuth APPs APIKey>@client",\n "jti": "<unique Identifier>"\n "aud":"`https://api.loginradius.com/identity/v2/manage", //or https://service.example.com/api/v2`\n "cid": "<APPConfig APIKey>",\n "sid": "<LR access Token>" \n "exp": 1311281970,\n "iat": 1311281670,\n "scp": [\n "profile:read",\n "profile:create",\n ],\n "gty":"client_credentials"\n}The client can call APIs (as per the defined scope) using the JWT token. APIs will work based on permissions without the use of Client Secret.
\ncurl --request GET \\\n --url `https://api.loginradius.com/identity/v2/manage/account/{uid} \\`\n --header 'authorization: Bearer eyJhb……….jVZ2w'\n --header 'X-LoginRadius-ApiKey: {apiKey}The client (partner, API, service, etc.) requests the access token using the following API:\nAPI endpoint: https://
POST https://<LoginRadiusAppName>.hub.loginradius.com/service/oauth/token\nContent-Type: application/json\n{\n"audience": "<business API endpoint>",\n"grant_type": "client_credentials",\n"client_id": "<YOUR_CLIENT_ID>",\n"client_secret": "<YOUR_CLIENT_SECRET>"\n}\n\nNote: Where
\n<LoginRadiusAppName>is the name of your LoginRadius App.\nIn response, the client will get an access token.
Use the generated JWT token in the authorization for APIs.
\ncurl --request GET \\\n--url < API URL > \\\n--header 'authorization: Bearer eyJh………VZ2w'Overall, M2M Authorization offers secure access to improve business efficiency — and ultimately enhances user experience. In detail, the benefits include but are not limited to:
\nM2M Authorization is a secure and reliable method of autonomous interactions. It aids business systems in achieving greater efficiency and eliminates the need for human involvement. It also enables businesses to provide flexible machine-to-machine communication while enforcing granular access, authorization, and security requirements.
\n","frontmatter":{"date":"April 29, 2022","updated_date":null,"description":"How can you ensure APIs, web services, and business systems communicate and access the information securely without human intervention? The answer is machine-to-machine (M2M) authorization.","title":"M2M Authorization: Authenticate Apps, APIs, and Web Services","tags":["M2M","Authorization","Authentication"],"pinned":null,"coverImage":{"childImageSharp":{"fluid":{"aspectRatio":1.5037593984962405,"src":"/static/55b15bddf195e3eaa39cb0e655abac95/ee604/m2m-authorization-for-apis-apps-and-web-services.png","srcSet":"/static/55b15bddf195e3eaa39cb0e655abac95/69585/m2m-authorization-for-apis-apps-and-web-services.png 200w,\n/static/55b15bddf195e3eaa39cb0e655abac95/497c6/m2m-authorization-for-apis-apps-and-web-services.png 400w,\n/static/55b15bddf195e3eaa39cb0e655abac95/ee604/m2m-authorization-for-apis-apps-and-web-services.png 800w,\n/static/55b15bddf195e3eaa39cb0e655abac95/f3583/m2m-authorization-for-apis-apps-and-web-services.png 1200w","sizes":"(max-width: 800px) 100vw, 800px"}}},"author":{"id":"Kundan Singh","github":null,"avatar":null}}}},{"node":{"excerpt":"Introduction People’s lives are full of digital footprints. They leave digital traces everywhere they go, and this is why it’s so important…","fields":{"slug":"/growth/people-important-in-customer-iam/"},"html":"People’s lives are full of digital footprints. They leave digital traces everywhere they go, and this is why it’s so important to secure your customer's digital identity.
\nAccording to a report, 92% of small-to-medium-sized businesses deal with identity challenges, and a whopping 95% of professionals expect strong password policies from their organizations.
\nNo wonder, identity management systems continue to evolve and aid organizations in securing their data. In this blog post, we will discuss the importance of people's in Customer IAM.
\nBlending Identity With Security Management
\nIdentity management refers to the process of identifying individuals based on their roles within an organization or their relationship with third parties such as suppliers or customers. It also involves managing user access privileges based on their requirements or permissions required by their job functions within the company structure.
\nIdentity influences different elements of an organization, and the most vital one among them is information security. So, it is fair to say that identity and security management run in the same circle.
\nA sound identity management system helps an organization identify its users and ensure they are who they say they are. This protects not just the organization but also its users from fraudulent attacks such as phishing and other forms of cybercrime.
\nBy integrating these two functions into one system, organizations can benefit from improved efficiency while reducing costs associated with managing them separately (particularly when considering how much time could be wasted trying to keep track of multiple passwords for different applications).
\nIn the world of identity management, customer experience is a crucial factor contributing to the digital mesh that underpins businesses.
\nBusinesses have historically associated identity management with security only. This process ensures that businesses can curb security threats by giving access to only authorized persons with the right resources. They can apply this rule not only to employees but also to customers.
\nHowever, recent research shows that customer experience plays a crucial role in ensuring a seamless and satisfying customer experience. Until recently, this system associated itself with only security.
\nThis means that when you are making an online purchase or applying for credit, your data is not being used just for security purposes but also for creating a better customer experience. This means that your data will be used to provide you with personalized content, targeted offers and recommendations based on your behavior and preferences.
\n In the tech world, we've seen significant improvements in security measures that make life easier for everyone. The most common examples include passwordless authentication, biometrics, voice recognition, etc. Enterprises are also starting to see those influences on customer experience in identity management. The biggest changes have been around security and convenience. For example, you can now use your face or fingerprint to log into your online bank account instead of having to remember a string of numbers and letters or type them in from a mobile device. There are also fewer steps involved in signing up for new accounts as companies like Facebook offer sign-up via Messenger and Twitter allows you to use your phone number as an identifier rather than creating a username and password combination (which is how most people sign up). These improvements have made life easier for everyone involved—from users who don't have to remember multiple passwords or keep track of one too many credit cards anymore; to companies who don't have to worry about protecting sensitive information anymore because there's no need for a traditional username/password combination. These are all great improvements! As we are living in a digital world, customers are expecting personalized experiences. The pandemic has witnessed a massive growth in customers who rely on digital channels. It has led to the acceleration of digital identity management in many organizations. Organizations must have the best identity management to support and control customer journeys within channels. That is to provide an excellent CX in identity management. Studies have shown that 79% of customers refuse to engage with brands if an excellent customer experience is missing. So, customer experience can make or break the reputation and profits of brands. Businesses that strive to provide the best customer experience in identity management must follow these steps. Customer experience and identity management go hand in hand. So, organizations must make sure they have the best digital systems to provide a personalized experience. LoginRadius helps organizations manage user identities to deliver a unified customer experience. Overall, it provides a secure and delightful experience for the customers using the innovative customer identity platform. Reach us out if you want more information about our identity management services! We are thrilled to announce the release of our annual industry report, Consumer Digital Identity Trend Report 2022. We surveyed over 500 brands and 1.17 billion users worldwide from the LoginRadius Identity Platform to provide an in-depth analysis of the consumer data market, including changes in consumer behavior over time and their projected impact on business practices and IT requirements. The next few years will be a pivotal time for the digital consumer identity space. One critical aspect covered in this report is that consumers are evolving from the traditional registration model to a more personalized, easy to authenticate model that's secure. Keeping up is a challenge – and it requires businesses to adjust their identity management systems. The report findings highlight that if your business wants to stand out in a highly competitive world, you’ll need to make a huge improvement in your interactions with your customers. This means not just your interactions with them but also theirs with your brand, starting from registration to checkout. Businesses can achieve this by tailoring authentication and login methods to their customers' preferences, such as passwordless login or multi-factor authentication via email or SMS, or social sign-on. As a company strongly focused on CIAM, we analyzed our global customers over the past year, and discovered the following: Some more findings of the report have been outlined in the infographic below. \n
\nEffect of New Security Measures on Customer Experience
\nClosing the Gap between Customer Experience and Identity Management
\n\n
\nSumming Up
\nIntroduction
\nEvolution is Essential for a Great Consumer Experience
\nKey Highlights of the Consumer Identity Report 2022
\n\n
\n
When your webapp has a large amount of data to visualize, you don't want your users to wait 10 seconds before seeing something.
\nOne technique that is often overlooked is HTTP streaming. It's broadly supported, works well, and doesn't require fancy libraries.
\nWe're going to go through how we can use HTTP streaming in our applications and what to consider when we do so.
\nWhen building web applications, we typically have a REST API with GET endpoints that do something like this:
\nThe API will typically wait for each step to complete before going on to the next one, and by step 4, the database result and the JSON objects are all in memory before the request is handled, and everything can be cleaned up.
\nThis works, and there is nothing wrong with it (KISS, right?) as long as your database query results are small and quickly available.
\nBut let's say you want to render a chart with 10k data points. Querying will not be as smooth anymore.\nThe simple way will work, but ideally, you don't want to accumulate all the data in memory before sending the response.
\nWith HTTP streaming, you can start rendering the chart even before your query is complete.
\nTo make it happen:
\nIn this example, we use Koa for the API, but you can use other libraries like Express or plain Node.js. Most will have support for streaming.
\nLet's create an API:
\nconst Koa = require('koa');\nconst app = new Koa();\n\napp.use(async (ctx) => {\n if (ctx.request.url === '/measurements.json') {\n ctx.response.set('content-type', 'application/json');\n // This is where the magic happens: set a stream as the response body\n ctx.body = fs.createReadStream('./measurements.json');\n }\n});\n\nhttp.createServer(app.callback()).listen(3000);This code creates an API with 1 endpoint GET /measurements that will respond with the contents of a JSON file with 10k measurements.
The file looks like this:
\n[\n { "id": "1", "timestamp": "2022-01-19T10:39:00.000Z", "value": 239.34 },\n { "id": "2", "timestamp": "2022-01-19T10:40:00.000Z", "value": 820.14 },\n { "id": "3", "timestamp": "2022-01-19T10:41:00.000Z", "value": 926.03 },\n { "id": "4", "timestamp": "2022-01-19T10:42:00.000Z", "value": 513.01 },\n // ...\n { "id": "99998", "timestamp": "2022-03-29T21:16:00.000Z", "value": 13.81 },\n { "id": "99999", "timestamp": "2022-03-29T21:17:00.000Z", "value": 465.28 },\n { "id": "100000", "timestamp": "2022-03-29T21:18:00.000Z", "value": 71.95 }\n]We're creating an HTTP/1.1 server with Node's http module. By setting ctx.body to a stream, data will be sent to the requester as soon as it is loaded using a mechanism called chunked transfer encoding.
This saves time and memory of your API because it doesn't have to accumulate the whole result in memory before sending the response.
\nIn a real application, you're probably using a database instead of a pre-created JSON file.\nIf you're using MongoDB, you can create a stream with the cursor's stream() method.
The GET /measurements endpoint we created can be consumed with any HTTP client, but you have to use the Fetch API to take advantage of streaming.
fetch() will set response.body to a ReadableStream for streaming responses.
Here's how you can read a streaming response:
\nfetch('http://localhost:3000/measurements.json')\n .then(async (response) => {\n // response.body is a ReadableStream\n const reader = response.body.getReader();\n for await (const chunk of readChunks(reader)) {\n console.log(`received chunk of size ${chunk.length}`);\n }\n });\n\n// readChunks() reads from the provided reader and yields the results into an async iterable\nfunction readChunks(reader) {\n return {\n async* [Symbol.asyncIterator]() {\n let readResult = await reader.read();\n while (!readResult.done) {\n yield readResult.value;\n readResult = await reader.read();\n }\n },\n };\n}If you run the API that we created and then run the code above in a web browser, you'll see received chunk of size x several times in the console with varying x:
To see it more clearly, open up Developer Tools (F12) and set network throttling to 3G. It will take longer for the file to download, so you can see that the chunks are being processed gradually.
\nThat's all very nice, but the chunks themselves are not very useful. You want to process the measurements that are in these chunks. Ideally, you would have an async iterable that gradually yields the JSON objects as they come in so that you can use for await to iterate over the measurements instead of the chunks.
JavaScript doesn't have a JSON parser that can deal with streams. Let's assume we have a function that can do this called parseJsonStream(readableStream). More details and a simple implementation can be found in \"Streaming Considerations\" below.
We would then be able to do this:
\nfetch('http://localhost:3000/measurements.json')\n .then(async (response) => {\n let measurementsReceived = 0;\n for await (const measurement of parseJsonStream(response.body)) {\n measurementsReceived++;\n // To prevent the console from flooding we only show 1 in every 100 measurements\n if (measurementsReceived % 100 === 0) {\n console.log(`measurement with id {${measurement.id}} at time ${measurement.timestamp} has value [${measurement.value}]`);\n }\n }\n });This is the result:
\n![\"The](\"/e2d673ca68b3af5f9fa335ce755032ed/console-measurements.gif\")
This is a very powerful mechanism. Instead of console.log() statements, imagine a line chart where the measurements gradually become visible as more data comes in.
This is an example created with Apache ECharts:
\n![\"A](\"/76f92b76f2a2c36236b5610800abb88c/chart-loading-gradually.gif\")
Before the Fetch API, it was impossible to do this because the alternative, XMLHttpRequest, will load the whole response into memory before providing it to your code.
Modern applications don't use XMLHttpRequest directly, but a lot of libraries like Axios or Angular's HttpClient rely on it to make requests.
People would rely on more advanced technologies like WebSockets to stream data.
\nYou might have heard that HTTP/2 has a more efficient mechanism for streaming, and you would be right. So let's see if we can use HTTP/2.
\nFrom the side of your webapp, the browser will automatically determine if it can communicate with the server over HTTP/2 and use it if it's available. The Fetch API will do this transparently, so you do not need to make any changes to your webapp.
\nWhat you need to do is make your API available over HTTP/2:
\nconst Koa = require('koa');\nconst app = new Koa();\n\napp.use(async (ctx) => {\n if (ctx.request.url === '/measurements.json') {\n ctx.response.set('content-type', 'application/json');\n ctx.body = fs.createReadStream('./measurements.json');\n }\n});\n\nhttp2.createSecureServer(\n {\n key: fs.readFileSync(path.resolve('path/to/localhost-key.pem')),\n cert: fs.readFileSync(path.resolve('path/to/localhost.pem')),\n },\n app.callback(),\n).listen(3000);This code is mostly the same as for HTTP/1.1 with two notable differences:
\nhttp2 module instead of http.HTTPS instead of plain HTTP because this is mandatory for HTTP/2. You can set up HTTPS and get the cert and key files using mkcert. Or, use one of the other mechanisms described in this article: Use HTTPS for Local DevelopmentThat's it!
\nIf you restart the API and check the network tab in Developer Tools, you'll see that your application will now stream over HTTP/2 (don't forget to update the URL in your webapp, start with https:// instead of http://).
In the code above, we assumed that there was a function parseJsonStream(readableStream) that would parse a ReadableStream containing JSON into an async iterable of objects.
The difficulty is that reading from a ReadableStream will give you chunks of data that don't necessarily correspond to anything meaningful. To illustrate, let's take a look at this example:
[\n { "id": "1", "timestamp": "2022-01-19T10:39:00.000Z", "value": 239.34 },\n { "id": "2", "timestamp": "2022-01-19T10:40:00.000Z", "value": 820.14 },\n { "id": "3", "timestamp": "2022-01-19T10:41:00.000Z", "value": 926.03 },\n { "id": "4", "timestamp": "2022-01-19T10:42:00.000Z", "value": 513.01 }\n]We could receive this JSON in chunks like this:
\n[\n { "id": "1", "timestamp": "2022-01-19T10:39:00.000Z", "value": 239.34 },\n { "id": "2", "tim\n\n\n\n estamp": "2022-01-19T10:40:00.000Z", "value": 820.14 },\n { "id": "3", "timestamp": "2022-01-19T10:41:00.000Z", "value": 926.03 },\n { "id": "4", "timestamp": "2022-01-19T10:42\n\n\n\n:00.000Z", "value": 513.01 }\n]You need some way to determine where one measurement object starts and ends. To simplify this, we created a JSON file where each line contains precisely one object. Parsing the stream becomes manageable when we can make this assumption.
\nHere is the implementation of parseJsonStream(readableStream)
async function *parseJsonStream(readableStream) {\n for await (const line of readLines(readableStream.getReader())) {\n const trimmedLine = line.trim().replace(/,$/, '');\n\n if (trimmedLine !== '[' && trimmedLine !== ']') {\n yield JSON.parse(trimmedLine);\n }\n }\n}\n\nasync function *readLines(reader) {\n const textDecoder = new TextDecoder();\n let partOfLine = '';\n for await (const chunk of readChunks(reader)) {\n const chunkText = textDecoder.decode(chunk);\n const chunkLines = chunkText.split('\\n');\n if (chunkLines.length === 1) {\n partOfLine += chunkLines[0];\n } else if (chunkLines.length > 1) {\n yield partOfLine + chunkLines[0];\n for (let i=1; i < chunkLines.length - 1; i++) {\n yield chunkLines[i];\n }\n partOfLine = chunkLines[chunkLines.length - 1];\n }\n }\n}\n\nfunction readChunks(reader) {\n return {\n async* [Symbol.asyncIterator]() {\n let readResult = await reader.read();\n while (!readResult.done) {\n yield readResult.value;\n readResult = await reader.read();\n }\n },\n };\n}If you have control over the API you're calling, you can use the \"1 object per line\" formatting as part of the contract, but know that it could be prone to breaking. For robust JSON support, we need a real streaming parser.
\nOther options include using a format with one object per line by default, like CSV, or a more advanced format with built-in support for streaming like Apache Arrow.
\nError handling becomes more difficult because HTTP status code 200 will be sent as soon as streaming starts. What do we do when something goes wrong in the middle of the stream?
\nWhen something goes wrong, your API should close the stream. Your webapp can then determine if the stream was complete and show a fitting message to the user if it's not. For example: when using a JSON response, as we discussed, you can check that the last line contains only \"]\".
\nYou have learned how to stream HTTP data efficiently using Node.js and HTTP without congesting or burdening the memory. You have also understood the advantages and disadvantages of HTTP streaming.
\n","frontmatter":{"date":"April 27, 2022","updated_date":null,"description":"Do you know that you can stream HTTP data for efficient visualization? Learn more about how you can stream data with HTTP using Node.js and Fetch API.","title":"Implement HTTP Streaming with Node.js and Fetch API","tags":["Node.js","Fetch API","Streaming"],"pinned":null,"coverImage":{"childImageSharp":{"fluid":{"aspectRatio":1.5037593984962405,"src":"/static/15f56fac896fb3f3370431c08e4ffbac/ee604/http-streaming-with-nodejs-and-fetch-api.png","srcSet":"/static/15f56fac896fb3f3370431c08e4ffbac/69585/http-streaming-with-nodejs-and-fetch-api.png 200w,\n/static/15f56fac896fb3f3370431c08e4ffbac/497c6/http-streaming-with-nodejs-and-fetch-api.png 400w,\n/static/15f56fac896fb3f3370431c08e4ffbac/ee604/http-streaming-with-nodejs-and-fetch-api.png 800w,\n/static/15f56fac896fb3f3370431c08e4ffbac/f3583/http-streaming-with-nodejs-and-fetch-api.png 1200w","sizes":"(max-width: 800px) 100vw, 800px"}}},"author":{"id":"Nick Van Nieuwenhuyse","github":"Nivani","avatar":null}}}},{"node":{"excerpt":"Introduction It is an indisputable reality that authentication is critical in any application or system if you want to secure user data and…","fields":{"slug":"/engineering/guest-post/session-authentication-with-nestjs-and-mongodb/"},"html":"It is an indisputable reality that authentication is critical in any application or system if you want to secure user data and enable secure access to information. Authentication is the procedure of establishing or demonstrating that something is true, legitimate, or valid.
\nThis tutorial is a hands-on demonstration. To follow along, ensure you have the following in place:
\n\nNest (NestJS) is a Node.js server-side application framework for building scalable, efficient applications.
\nIt is written in TypeScript and built on Express, a very minimalistic framework that is great on its own but lacks structure. It combines programming paradigms such as object-oriented programming, functional programming, and functional reactive programming.
\nIt is a framework to use if you want a lot of structure on your backend. Its syntax and structure are very similar to AngularJS, a front-end framework. And it uses TypeScript, services, and dependency injection in the same way that AngularJS does.
\nIt employs modules and controllers, and you can build controllers for a file using the command-line interface.
\nNestJS modules allow you to group related controllers and service providers into a single code file. Simply put, a NestJS module is a TypeScript file with the @Module annotation (). This decorator informs the NestJS framework about which controllers, service providers, and other associated resources will be instantiated and used by the app code later.
\nSession-based authentication is a method of user authentication in which the server creates a session after a successful log-in, with the session ID stored in a cookie or local storage in your browser.
\nUpon subsequent requests, your cookie is validated against the session ID stored on the server. If there is a match, the request is considered valid and processed.
\nWhen using this authentication method, it is critical to keep the following security best practices in mind:
\nSession-based authentication is more secure than most authentication methods because it is simple, secure, and has a limited storage size. It is also thought to be the best option for websites in the same root domain.
\nStart your project setup by installing Nest CLI globally. You don’t need to do this if you already have NestJS CLI installed.
\nThe Nest CLI is a command-line interface tool for setting up, developing, and maintaining Nest applications.
\nnpm i -g @nestjs/cliNow, let’s set up your project by running the following command:
\nnest new session-based-authThe above command creates a Nest application with some boilerplates, then prompts you to choose your preferred package manager to install the required modules to run your application. For demonstration, this tutorial uses npm. Hit the enter key to continue with npm.
\nThe above command installs Passport.js, a popular nest.js authentication library. Also, install the types for the strategy with the command below: It contains type definitions for To set up and connect your database, install the Mongoose package and the NestJS wrapper with the following command: The Mongoose NestJS wrapper helps you use Mongoose in the NestJS application and gives approved TypeScript support. Now, head over to your Setting up your database connection in For separation concerns, to make your code clean and well organized, create a module specifically for users using the NestJS CLI by running the following command: The above command creates a Also, create Note that you can create your folders and files manually without using the nest CLI, but using the CLI automatically updates the necessary folders and makes your life easier. The next step is to create your UserSchema, but first, add a This should be the shape of our application To create Also, create an interface for your Model that extends mongoose, a document that helps you populate your MongoDB collections. Head over to your This will enable you to share the file anywhere with the help of dependency injection. In It's usually a good idea to encapsulate the business logic in a separate class. Such a class is known as a service. The job of this class is to process the controller's requests and perform the business logic. In Now that the The most critical aspect of the registration procedure is the users’ passwords, which must not be saved in plain text. It is the responsibility of the user to create a strong password, but it is your obligation as a developer to keep their passwords secure. If a database breach occurs, the users' passwords would be exposed. And what happens if it’s stored in plain text? I believe you know the answer. To address this, hash the passwords using bcrypt. So, install With that out of the way, set up your controller. First, import your The registration happens in the Congratulations! You are done with the registration. You can now register a user with a username and password. Now, with registration out of the way, add a Just as for users, create an auth module and service specifically for all the authentications/verifications. To do that, run the following commands: The above will create an auth folder, At this point, the shape of your application The above generate command will update your Go to your In your To add some basic validations, check if the user exists in the database, and compare the given password with the one in your database to ensure it matches. If it exists, return the user in the Going further, create a new file and name it Create a constructor and inject the Go back to your Now, add the login route to your Now that you have all these put in place, you still cannot log in a user because there is nothing to trigger the login route. Here, use Guards to achieve that. Create a file and name it Add the Finally, you can log in a user with a registered username and password. You have successfully set up user authentication. Now, protect your routes from unauthorized access by limiting access to just authenticated users. Go to your The protected route in the above code will return an empty object instead of returning the user’s details when a logged-in user makes a request to it because it already lost the login. To get that sorted, this is where the session-based authentication comes in. In session-based authentication, when a user logs in, the user is saved in a session so that any subsequent request by the user after login will grab the details from the session and grant the user easy access. The session expires when the user logs out. To start session-based auth, install express-session and the NestJS types using the following command: When the installation is completed, go to your Import everything from It is preferable to keep your secret key in your environment variables. Add a new file, In the above code, the request is gotten from the context and checked if authenticated. To trigger the login, in your At this point, it still fails because you've only configured When a user logs in, you need to save the user in a session so that the user can access other routes with the session. One thing to keep in mind is that by default, the Before it goes into the session, you need to serialize the user. As it comes out of the session, deserialize the user. So, create a new file in the auth folder for serializer and deserializer, name it At this point, the shape of our application Go back to your Add some codes within the Call the If you log in now, you will see the session ID stored in a cookie, which is just a key to the session store, and the cookie gets saved in the browser. The cookie is automatically attached to the rest of the request. Now that the session is working, you can access the protected route; it will return the expected user’s details. As mentioned earlier, once a user logs out, you destroy all sessions. To log out a user, go to the So, once you log out, it returns a message notifying you that the user session has ended. The code for this tutorial is hosted here on my Github repository. You have successfully implemented user signup, authentication, and protected the route to enable authorized access only. It’s time to test the application. If everything is in order, your server should be running. Else, restart your server with the following command: Head over to your Postman. And let’s finally test our application. LoginRadius provides a variety of registration and authentication services to assist you in better connecting with your consumers. On any web or mobile application, LoginRadius is the developer-friendly Identity Platform that delivers a complete set of APIs for authentication, identity verification, single sign-on, user management, and account protection capabilities like multi-factor authentication. To implement LoginRadius in your NestJS application, follow this tutorial: NestJS User Authentication with LoginRadius API. Congratulations! In this tutorial, you've learned how to implement session-based authentication in a NestJS application with the MongoDB database. You've created and authenticated a user and protected your routes from unauthorized access. You can access the sample code used in this tutorial on GitHub. Note: Session storage is saved by default in 'MemoryStore,' which is not intended for production use. So, while no external datastore is required for development, once in production, a data store such as Redis or another is suggested for stability and performance. You can learn more about session storage here. With technology evolving leaps and bounds and businesses consistently emphasizing a seamless customer experience, customer security is often neglected. Businesses underestimate the importance of delivering rich consumer experiences backed with robust security. They believe customers aren’t concerned about their information security and how their personal information is managed. However, a recent survey by Statista revealed that over 90% of global online users had at least one significant concern regarding data privacy. And around 47% of the total respondents were worried that their personal information could be exposed in a data breach. So does it mean every online business should focus more on customer security than improving overall consumer experience since balancing both aspects (security & UX) is tricky, especially when competitors are just a click away? No! Businesses can leverage a cutting-edge consumer identity and access management (CIAM) solution that creates a perfect balance between customer security and customer experience. Let’s uncover the aspects of a robust CIAM solution and how it helps businesses stay ahead of their competitors. In the past couple of years, consumers have gotten a big wake-up call about the value of their data and the risks they run if it’s leaked, stolen, or misused. Moreover, several high-profile hacks and breaches have generated widespread awareness of how negligent enterprises can be. And consumers are much more careful about which brands they do business with. On the other hand, stringent consumer privacy legislation has spread to new jurisdictions, such as the General Data Protection Regulation (GDPR). Even the most prominent companies aren’t exempted from significant fines. If consumers don’t trust your business to protect their data and accounts, they’ll find another one. The digital world makes it easy for them to switch providers within a few clicks. To keep pace with the ever-growing digital world, enterprises need to create a perfect harmony of a great user experience and robust security. This can be achieved by leveraging a consumer identity and access management (CIAM) solution like LoginRadius. The cutting-edge technology coupled with a great user experience from the beginning when your consumers first interact with your brand helps build consumer trust that guarantees conversion. Moreover, the best-in-class security that comes with the LoginRadius Identity Platform lets you assure your consumers of how vigilant you are about data privacy and security. An omnichannel consumer experience refers to seamless interaction across multiple channels. Consumer expectations fall into speed, flexibility, reliability, and transparency. For example, it is omnichannel when marketing, sales, consumer support, and even in-store experiences are synced up so users can seamlessly switch channels and make the purchase. That may include the basic information about a consumer, the past and present purchasing data, interactions with customer service, and their social media behavior under a single admin panel. It assists brands in having an in-depth insight into their consumers. In an age where sensational hacking and malicious attacks have become the order of the day, enhanced safeguard against the ever-looming threats is indispensable. By adding multiple layers of shields in the form of multi-factor authentication (MFA) and risk-based authentication (RBA), the new-age CIAM strengthens security. Thus, the entire cluster of data remains protected from the prying eyes or, for that matter, falling prey to data trackers. LoginRadius' modern CIAM solution is designed to be more flexible and intuitive. It addresses every subtle component that can improve consumers' experience while also providing an unmatched safeguard for private data. What puts LoginRadius ahead of the curve are the three most fundamental aspects: With the high number of cybersecurity threats affecting global businesses, it’s high time business leaders need to incorporate stringent security mechanisms to ensure consumer data remains secure. Moreover, at the same time, equal emphasis should be given to delivering rich consumer experiences since today’s consumers are always seeking great usability across every online platform. Hence, the critical role of a CIAM solution in enhancing customer security and improving consumer experience can’t be overlooked. Businesses need to invoke the potential of a reliable CIAM like LoginRadius to ensure they get perfect harmony of user experience and security. Identity is evolving, and developers are at the forefront of this transformation. Every day brings a new learning—adapting to new standards and refining approaches to building secure, seamless experiences. We’re here to support developers on that journey. We know how important simplicity, efficiency, and well-structured documentation are when working with identity and access management solutions. That’s why we’ve redesigned the LoginRadius website—to be faster, more intuitive, and developer-first in every way. The goal? Having them spend less time searching and more time building. LoginRadius’ vision is to give developers a product that simplifies identity management so they can focus on building, deploying, and scaling their applications. To enhance this experience, we’ve spent the last few months redesigning our interface— making navigation more intuitive and reassuring that essential resources are easily accessible. Here’s a closer look at what’s new and why it’s important: Developers spend long hours working in dark-themed IDEs and terminals, so we’ve designed the LoginRadius experience to be developer-friendly and align with that preference. The new dark mode reduces eye strain, enhances readability, and provides a seamless transition between a coding environment and our platform. Our new design features a clean, modern aesthetic with a consistent color scheme and Barlow typography, ensuring better readability. High-quality graphics and icons are thoughtfully placed to enhance the content without adding visual clutter. So, whether you’re navigating our API docs or configuring authentication into your system, our improved interface will make those extended development hours more comfortable and efficient. We’ve restructured our website to provide a straightforward breakdown of our customer identity and access management platform capabilities, helping you quickly find what you need: This structured layout ensures you can quickly understand each capability and how it integrates into your identity ecosystem. We’ve been analyzing developer workflows to identify how you access key resources. That’s why we redesigned our navigation with one goal in mind: to reduce clicks and make essential resources readily available. The new LoginRadius structure puts APIs, SDKs, and integration guides right at the menu bar under the Developers dropdown so you can get started faster. Our Products, Solutions, and Customer Services are also clearly categorized, helping development teams quickly find the right tools and make informed decisions. Developers now have a clear view of the tech stack available with LoginRadius, designed to support diverse business needs. Our platform offers pre-built SDKs for Node.js, Python, Java, and more, making CIAM integration seamless across popular programming languages and frameworks. Check out our revamped LoginRadius website and see how the improved experience makes it easier to build, scale, and secure your applications. Do not forget to explore the improved navigation and API documentation, and get started with our free trial today. We’re excited to see what you’ll build with LoginRadius!
\nnpm install --save @nestjs/passport passport passport-localpassport-local.
\nnpm install --save-dev @types/passport-localSet Up MongoDB Database in NestJS
\n
\nnpm install --save @nestjs/mongoose mongooseapp.module.ts, and import the mongoose module from @nestjs/mongoose. Then call the forRoot() method, a method provided by the Mongoose module, and pass in your database URL string.app.module.ts helps your application connect to the database immediately as the server starts — after running your application since it’s the first module to be loaded.app.module.ts
\nimport { Module } from "@nestjs/common"\nimport { MongooseModule } from "@nestjs/mongoose"\nimport { AppController } from "./app.controller"\nimport { AppService } from "./app.service"\n\n@Module({\n imports: [\n MongooseModule.forRoot(\n "mongodb+srv://<username>:<password>@cluster0.kngtf.mongodb.net/session-auth?retryWrites=true&w=majority"\n ),\n ],\n controllers: [AppController],\n providers: [AppService],\n})\nexport class AppModule {}Create Users Module
\n
\nnest g module usersusers folder with users.module.ts and updates app.module.tsusers.service.ts and users.controller.ts files with the following commands:
\nnest g service users\nnest g controller usersCreate User Schema
\nusers.model.ts file, where you will create UserSchemasrc folder now.
\n└───src\n│ └───users\n│ │ └───users.controller.ts\n│ │ └───users.model.ts\n│ │ └───users.module.ts\n│ │ └───users.service.ts\n│ └───app.controller.ts\n│ └───app.module.ts\n│ └───app.service.ts\n│ └───main.tsUserSchema, import everything as mongoose from the mongoose package in users.model.ts. Then call the new mongoose schema, a blueprint of the user Model, and pass in a JavaScript object where you will define the user object and data.users.model.ts
\nimport * as mongoose from "mongoose"\nexport const UserSchema = new mongoose.Schema(\n {\n username: {\n type: String,\n required: true,\n unique: true,\n },\n password: {\n type: String,\n required: true,\n },\n },\n { timestamps: true }\n)\n\nexport interface User extends mongoose.Document {\n _id: string;\n username: string;\n password: string;\n}users.module.ts and import MongooseModule in the imports array. Then call the forFeature() method provided by MongooseModule, and pass in an array of object that takes in name and schema.users.module.ts
\nimport { Module } from "@nestjs/common"\nimport { MongooseModule } from "@nestjs/mongoose"\nimport { UsersController } from "./users.controller"\nimport { UserSchema } from "./users.model"\nimport { UsersService } from "./users.service"\n@Module({\n imports: [MongooseModule.forFeature([{ name: "user", schema: UserSchema }])],\n controllers: [UsersController],\n providers: [UsersService],\n})\nexport class UsersModule {}users.module.ts, export the UsersService to enable you to access it in another module.users.module.ts
\nimport { Module } from "@nestjs/common"\nimport { MongooseModule } from "@nestjs/mongoose"\nimport { UsersController } from "./users.controller"\nimport { UserSchema } from "./users.model"\nimport { UsersService } from "./users.service"\n@Module({\n imports: [MongooseModule.forFeature([{ name: "user", schema: UserSchema }])],\n controllers: [UsersController],\n providers: [UsersService],\n exports: [UsersService],\n})\nexport class UsersModule {}users.service.ts file, import Model from mongoose, User from users.model.ts, and InjectModel from @nestjs/mongoose. Then add a method to the UsersService class that takes a username and password, and call the method insertUser().users.service.ts
\nimport { Injectable } from '@nestjs/common';\nimport { InjectModel } from '@nestjs/mongoose';\nimport { Model } from 'mongoose';\nimport { User } from './users.model';\n@Injectable()\nexport class UsersService {\n constructor(@InjectModel('user') private readonly userModel: Model<User>) {}\n async insertUser(userName: string, password: string) {\n const username = userName.toLowerCase();\n const newUser = new this.userModel({\n username,\n password,\n });\n await newUser.save();\n return newUser;\n }\n}UsersService class is ready, you need to inject it into your controller. But first, let's talk about storing the users' passwords securely.bcrypt and @types/bcrypt with the following command:
\nnpm install @types/bcrypt bcryptUsersService class and everything from bcrypt. Then add a constructor and a method that allows you to add a user; it will handle incoming post requests, call it addUser, with a function body where you'll hash the password.users.controller.ts
\nimport { Body, Controller, Post } from '@nestjs/common';\nimport { UsersService } from './users.service';\nimport * as bcrypt from 'bcrypt';\n@Controller('users')\nexport class UsersController {\n constructor(private readonly usersService: UsersService) {}\n //post / signup\n @Post('/signup')\n async addUser(\n @Body('password') userPassword: string,\n @Body('username') userName: string,\n ) {\n const saltOrRounds = 10;\n const hashedPassword = await bcrypt.hash(userPassword, saltOrRounds);\n const result = await this.usersService.insertUser(\n userName,\n hashedPassword,\n );\n return {\n msg: 'User successfully registered',\n userId: result.id,\n userName: result.username\n };\n }\n}app.module.ts file, which is achieved by adding the UsersModule to the @Module() decorator's imports' array in app.module.ts.app.module.ts
\nimport { Module } from "@nestjs/common"\nimport { MongooseModule } from "@nestjs/mongoose"\nimport { AppController } from "./app.controller"\nimport { AppService } from "./app.service"\nimport { UsersModule } from "./users/users.module"\n\n@Module({\n imports: [\n MongooseModule.forRoot(\n "mongodb+srv://<username>:<password>@cluster0.kngtf.mongodb.net/session-auth?retryWrites=true&w=majority"\n ),\n UsersModule,\n ],\n controllers: [AppController],\n providers: [AppService],\n})\nexport class AppModule {}getUser function to your UsersService with the findOne method to find a user by username.users.service.ts
\nimport { Injectable } from '@nestjs/common';\nimport { InjectModel } from '@nestjs/mongoose';\nimport { Model } from 'mongoose';\nimport { User } from './users.model';\n@Injectable()\nexport class UsersService {\n constructor(@InjectModel('user') private readonly userModel: Model<User>) {}\n async insertUser(userName: string, password: string) {\n const username = userName.toLowerCase();\n const newUser = new this.userModel({\n username,\n password,\n });\n await newUser.save();\n return newUser;\n }\n async getUser(userName: string) {\n const username = userName.toLowerCase();\n const user = await this.userModel.findOne({ username });\n return user;\n }\n}Create Authentication Module
\n
\nnest g module auth\nnest g service authauth.module.ts, and auth.service.ts, and update the auth.module.ts and app.module.ts files.src folder should look as follows.
\n└───src\n│ └───auth\n│ │ └───auth.module.ts\n│ │ └───auth.service.ts\n│ └───users\n│ │ └───users.controller.ts\n│ │ └───users.model.ts\n│ │ └───users.module.ts\n│ │ └───users.service.ts\n│ └───app.controller.ts\n│ └───app.module.ts\n│ └───app.service.ts\n│ └───main.tsapp.module.ts, and it will look like the code snippet below:app.module.ts
\nimport { Module } from "@nestjs/common"\nimport { MongooseModule } from "@nestjs/mongoose"\nimport { AppController } from "./app.controller"\nimport { AppService } from "./app.service"\nimport { UsersModule } from "./users/users.module"\nimport { AuthModule } from './auth/auth.module';\n\n\n@Module({\n imports: [UsersModule, AuthModule, MongooseModule.forRoot(\n //database url string\n 'mongodb://localhost:27017/myapp'\n )],\n controllers: [AppController],\n providers: [AppService],\n})\nexport class AppModule {}Authenticate Users
\nauth.module.ts file and add UsersModule in the imports array to enable access to the UsersService exported from the users.module.ts file.auth.module.ts
\nimport { Module } from "@nestjs/common"\nimport { UsersModule } from "src/users/users.module"\nimport { AuthService } from "./auth.service"\n\n@Module({\n imports: [UsersModule],\n providers: [AuthService],\n})\nexport class AuthModule {}auth.service.ts file, call the constructor so you can inject the UsersService, and add a method for validation that will take a username and password.request.user object — else, return null.auth.service.ts
\n import { Injectable, NotAcceptableException } from '@nestjs/common';\n import { UsersService } from 'src/users/users.service';\n import * as bcrypt from 'bcrypt';\n\n @Injectable()\n export class AuthService {\n constructor(private readonly usersService: UsersService) {}\n async validateUser(username: string, password: string): Promise<any> {\n const user = await this.usersService.getUser(username);\n const passwordValid = await bcrypt.compare(password, user.password)\n if (!user) {\n throw new NotAcceptableException('could not find the user');\n }\n if (user && passwordValid) {\n return {\n userId: user.id,\n userName: user.username\n };\n }\n return null;\n }\n }local.strategy.ts. This file will represent the strategy from Passport.js, which you installed earlier, that is the local strategy. And within it, pass in the strategy, which is the Strategy from passport-local.AuthService, call the super() method; ensure to call the super() method.local.strategy.ts
\n import { Injectable, UnauthorizedException } from '@nestjs/common';\n import { PassportStrategy } from '@nestjs/passport';\n import { Strategy } from 'passport-local';\n import { AuthService } from './auth.service';\n @Injectable()\n export class LocalStrategy extends PassportStrategy(Strategy) {\n constructor(private readonly authService: AuthService) {\n super();\n }\n async validate(username: string, password: string): Promise<any> {\n const userName = username.toLowerCase();\n const user = await this.authService.validateUser(userName, password);\n if (!user) {\n throw new UnauthorizedException();\n }\n return user;\n }\n }auth.module.ts file. Then add PassportModule to imports and LocalStrategy to providers.auth.module.ts
\nimport { Module } from "@nestjs/common"\nimport { PassportModule } from "@nestjs/passport"\nimport { UsersModule } from "src/users/users.module"\nimport { AuthService } from "./auth.service"\nimport { LocalStrategy } from "./local.strategy"\n\n@Module({\n imports: [UsersModule, PassportModule],\n providers: [AuthService, LocalStrategy],\n})\nexport class AuthModule {}users.controller.ts:users.controller.ts
\n import {\n Body,\n Controller,\n Post,\n Request,\n } from '@nestjs/common';\n import * as bcrypt from 'bcrypt';\n import { UsersService } from './users.service';\n @Controller('users')\n export class UsersController {\n constructor(private readonly usersService: UsersService) {}\n //post / signup\n @Post('/signup')\n async addUser(\n @Body('password') userPassword: string,\n @Body('username') userName: string,\n ) {\n const saltOrRounds = 10;\n const hashedPassword = await bcrypt.hash(userPassword, saltOrRounds);\n const result = await this.usersService.insertUser(\n userName,\n hashedPassword,\n );\n return {\n msg: 'User successfully registered',\n userId: result.id,\n userName: result.username\n };\n }\n //Post / Login\n @Post('/login')\n login(@Request() req): any {\n return {User: req.user,\n msg: 'User logged in'};\n }\n }local.auth.guard.ts, then a class LocalAuthGuard that extends AuthGuard from NestJS/passport, where you will provide the name of the strategy and pass in the name of your strategy, local.local.auth.guard.ts.
\nimport { Injectable } from "@nestjs/common"\nimport { AuthGuard } from "@nestjs/passport"\n@Injectable()\nexport class LocalAuthGuard extends AuthGuard("local") {}UseGuard decorator to your login route in the users.controller.ts file, and pass in the LocalAuthGuard.users.controller.ts
\n import {\n Body,\n Controller,\n Post,\n UseGuards,\n Request,\n } from '@nestjs/common';\n import * as bcrypt from 'bcrypt';\n import { LocalAuthGuard } from 'src/auth/local.auth.guard';\n import { UsersService } from './users.service';\n @Controller('users')\n export class UsersController {\n constructor(private readonly usersService: UsersService) {}\n //post / signup\n @Post('/signup')\n async addUser(\n @Body('password') userPassword: string,\n @Body('username') userName: string,\n ) {\n const saltOrRounds = 10;\n const hashedPassword = await bcrypt.hash(userPassword, saltOrRounds);\n const result = await this.usersService.insertUser(\n userName,\n hashedPassword,\n );\n return {\n msg: 'User successfully registered',\n userId: result.id,\n userName: result.username\n };\n }\n //Post / Login\n @UseGuards(LocalAuthGuard)\n @Post('/login')\n login(@Request() req): any {\n return {User: req.user,\n msg: 'User logged in'};\n }\n }Protect Authentication Routes
\nusers.controller.ts file, and add another route — name it ‘protected’ and make it return the req.user object.users.controller.ts
\n import {\n Body,\n Controller,\n Get,\n Post,\n UseGuards,\n Request,\n } from '@nestjs/common';\n import * as bcrypt from 'bcrypt';\n import { LocalAuthGuard } from 'src/auth/local.auth.guard';\n import { UsersService } from './users.service';\n @Controller('users')\n export class UsersController {\n constructor(private readonly usersService: UsersService) {}\n //signup\n @Post('/signup')\n async addUser(\n @Body('password') userPassword: string,\n @Body('username') userName: string,\n ) {\n const saltOrRounds = 10;\n const hashedPassword = await bcrypt.hash(userPassword, saltOrRounds);\n const result = await this.usersService.insertUser(\n userName,\n hashedPassword,\n );\n return {\n msg: 'User successfully registered',\n userId: result.id,\n userName: result.username\n };\n }\n //Post / Login\n @UseGuards(LocalAuthGuard)\n @Post('/login')\n login(@Request() req): any {\n return {User: req.user,\n msg: 'User logged in'};\n }\n // Get / protected\n @Get('/protected')\n getHello(@Request() req): string {\n return req.user;\n }\n }
\nnpm install express-session @types/express-sessionmain.ts file, the root of your application, and do the configurations there.passport and express-session, then add passport initialize and passport session.main.ts
\nimport { NestFactory } from "@nestjs/core"\nimport { AppModule } from "./app.module"\nimport * as session from "express-session"\nimport * as passport from "passport"\nasync function bootstrap() {\n const app = await NestFactory.create(AppModule)\n app.use(\n session({\n secret: "keyboard",\n resave: false,\n saveUninitialized: false,\n })\n )\n app.use(passport.initialize())\n app.use(passport.session())\n\n await app.listen(3000)\n}\nbootstrap()authenticated.guard.ts, in your auth folder. And create a new Guard that checks if there is a session for the user making the request — name it authenticatedGuard.authenticated.guard.ts
\nimport { CanActivate, ExecutionContext, Injectable } from "@nestjs/common"\n\n@Injectable()\nexport class AuthenticatedGuard implements CanActivate {\n async canActivate(context: ExecutionContext) {\n const request = context.switchToHttp().getRequest()\n return request.isAuthenticated()\n }\n}isAuthenticated() comes from passport.js automatically; it says. \"hey! does a session exist for this user? If so, keep going.\"users.controller.ts file:\n
\nauthenticated from authenticated.guard.ts;useGuard decorator to the protected route; and,AuthenticatedGuard.users.controller.ts
\n import {\n Body,\n Controller,\n Get,\n Post,\n UseGuards,\n Request,\n } from '@nestjs/common';\n import * as bcrypt from 'bcrypt';\n import { AuthenticatedGuard } from 'src/auth/authenticated.guard';\n import { LocalAuthGuard } from 'src/auth/local.auth.guard';\n import { UsersService } from './users.service';\n @Controller('users')\n export class UsersController {\n constructor(private readonly usersService: UsersService) {}\n //signup\n @Post('/signup')\n async addUser(\n @Body('password') userPassword: string,\n @Body('username') userName: string,\n ) {\n const saltOrRounds = 10;\n const hashedPassword = await bcrypt.hash(userPassword, saltOrRounds);\n const result = await this.usersService.insertUser(\n userName,\n hashedPassword,\n );\n return {\n msg: 'User successfully registered',\n userId: result.id,\n userName: result.username\n };\n }\n //Post / Login\n @UseGuards(LocalAuthGuard)\n @Post('/login')\n login(@Request() req): any {\n return {User: req.user,\n msg: 'User logged in'};\n }\n //Get / protected\n @UseGuards(AuthenticatedGuard)\n @Get('/protected')\n getHello(@Request() req): string {\n return req.user;\n }\n }express-session but didn't implement it.express-session library stores the session in the web server's memory.session.serializer.ts.src folder should look like this.
\n └───src\n │ └───auth\n │ │ └───auth.module.ts\n │ │ └───auth.service.ts\n │ │ └───authenticated.guard.ts\n │ │ └───local.auth.guard.ts\n │ │ └───local.strategy.ts\n │ │ └───session.serializer.ts\n │ └───users\n │ │ └───users.controller.ts\n │ │ └───users.model.ts\n │ │ └───users.module.ts\n │ │ └───users.service.ts\n │ └───app.controller.ts\n │ └───app.module.ts\n │ └───app.service.ts\n │ └───main.tssession.serializer.ts
\nimport { Injectable } from "@nestjs/common"\nimport { PassportSerializer } from "@nestjs/passport"\n\n@Injectable()\nexport class SessionSerializer extends PassportSerializer {\n serializeUser(user: any, done: (err: Error, user: any) => void): any {\n done(null, user)\n }\n deserializeUser(\n payload: any,\n done: (err: Error, payload: string) => void\n ): any {\n done(null, payload)\n }\n}auth.module.ts file, provide the SessionSerializer, and add the register method to the PassportModule.auth.module.ts
\nimport { Module } from "@nestjs/common"\nimport { PassportModule } from "@nestjs/passport"\nimport { UsersModule } from "src/users/users.module"\nimport { AuthService } from "./auth.service"\nimport { LocalStrategy } from "./local.strategy"\nimport { SessionSerializer } from "./session.serializer"\n\n@Module({\n imports: [UsersModule, PassportModule.register({ session: true })],\n providers: [AuthService, LocalStrategy, SessionSerializer],\n})\nexport class AuthModule {}LocalAuthGuard in the local.auth.guard.ts file.login method in super and pass in the request to trigger the actual login by creating a session. If you want to use sessions, you must remember to trigger the super.login().local.auth.guard.ts
\n import { ExecutionContext, Injectable } from '@nestjs/common';\n import { AuthGuard } from '@nestjs/passport';\n @Injectable()\n export class LocalAuthGuard extends AuthGuard('local') {\n async canActivate(context: ExecutionContext) {\n const result = (await super.canActivate(context)) as boolean;\n const request = context.switchToHttp().getRequest();\n await super.logIn(request);\n return result;\n }\n }Logout Users
\nusers.controller.ts file, add a logout route, and call the req.session.session() method. You can return a message notifying that the user’s session has ended.
\n import {\n Body,\n Controller,\n Get,\n Post,\n UseGuards,\n Request,\n } from '@nestjs/common';\n import * as bcrypt from 'bcrypt';\n import { AuthenticatedGuard } from 'src/auth/authenticated.guard';\n import { LocalAuthGuard } from 'src/auth/local.auth.guard';\n import { UsersService } from './users.service';\n @Controller('users')\n export class UsersController {\n constructor(private readonly usersService: UsersService) {}\n //signup\n @Post('/signup')\n async addUser(\n @Body('password') userPassword: string,\n @Body('username') userName: string,\n ) {\n const saltOrRounds = 10;\n const hashedPassword = await bcrypt.hash(userPassword, saltOrRounds);\n const result = await this.usersService.insertUser(\n userName,\n hashedPassword,\n );\n return {\n msg: 'User successfully registered',\n userId: result.id,\n userName: result.username\n };\n }\n //Post / Login\n @UseGuards(LocalAuthGuard)\n @Post('/login')\n login(@Request() req): any {\n return {User: req.user,\n msg: 'User logged in'};\n }\n //Get / protected\n @UseGuards(AuthenticatedGuard)\n @Get('/protected')\n getHello(@Request() req): string {\n return req.user;\n }\n //Get / logout\n @Get('/logout')\n logout(@Request() req): any {\n req.session.destroy();\n return { msg: 'The user session has ended' }\n }\n }Test Your Application
\n
\nnpm run start:devSign Up As a User
\nLog In As a User
\nLogged-in User’s Cookie ID
\nUser Logout
\nAlternatively, Implement User Authentication with LoginRadius
\nConclusion
\n\n
\n","frontmatter":{"date":"April 26, 2022","updated_date":null,"description":"Want to implement user authentication for your NestJS apps? Follow this tutorial to learn how you can implement session-based authentication for your NestJS apps along with MongoDB.","title":"NestJS: How to Implement Session-Based User Authentication","tags":["Authentication","NestJS","MongoDB","Node.js"],"pinned":null,"coverImage":{"childImageSharp":{"fluid":{"aspectRatio":1.5037593984962405,"src":"/static/d28db627e3ed8b9cfc8febf39b1cefad/ee604/session-based-authentication-in-nestjs.png","srcSet":"/static/d28db627e3ed8b9cfc8febf39b1cefad/69585/session-based-authentication-in-nestjs.png 200w,\n/static/d28db627e3ed8b9cfc8febf39b1cefad/497c6/session-based-authentication-in-nestjs.png 400w,\n/static/d28db627e3ed8b9cfc8febf39b1cefad/ee604/session-based-authentication-in-nestjs.png 800w,\n/static/d28db627e3ed8b9cfc8febf39b1cefad/f3583/session-based-authentication-in-nestjs.png 1200w","sizes":"(max-width: 800px) 100vw, 800px"}}},"author":{"id":"Ekekenta Odionyenfe Clinton","github":"icode247","avatar":null}}}},{"node":{"excerpt":"Introduction With technology evolving leaps and bounds and businesses consistently emphasizing a seamless customer experience, customer…","fields":{"slug":"/growth/how-businesses-approach-customer-security/"},"html":"Introduction
\nThe Importance of Customer Security for Your Enterprise and Customers
\nUser Experience with Robust Customer Security - The Key to Success in 2022 and Beyond
\nHow does a CIAM Pave the Path for a Rich Customer Experience with Security?
\n#1. Omni-channel consumer experience
\n#3. The highest level of customer security
\nWhy Should Businesses Rely on LoginRadius CIAM?
\n\n
\nThe Bottom Line
\nWhat’s New and Improved on the LoginRadius Website?
\nA Developer-Friendly Dark Theme
\n![\"This](\"/f46881583c7518a93bb24e94c32320de/a-developer-friendly-dark-theme.webp\")
Clear Categorization for LoginRadius Capabilities
\n![\"This](\"/e5358b82be414940f3fb146013845933/capabilities.webp\")
\n
\nDeveloper-First Navigation
\n![\"This](\"/a8c155c2b6faf3d5f4b4de4e2b14d763/developers-menu.webp\")
Quick Understanding of Integration Benefits
\n![\"This](\"/b2f9a964a2da0ea83e2f8596b833bba7/we-support-your-tech-stack.webp\")
Over to You Now!
\n