{"componentChunkName":"component---src-pages-markdown-remark-fields-slug-js","path":"/engineering/guest-post/nestjs-authentication-with-loginradius-api/","result":{"data":{"markdownRemark":{"id":"9ea233d4-d281-51da-aa88-fb8b677e538d","excerpt":"To create secure applications, you need a way to authenticate and authorize your users. In this tutorial, you will learn to authenticate users in your NestJS…","html":"

To create secure applications, you need a way to authenticate and authorize your users. In this tutorial, you will learn to authenticate users in your NestJS apps using LoginRadius Authentication API.

\n

Authentication vs. Authorization

\n

Authentication and authorization are often seen as similar concepts, but they are not. Authentication is the process of verifying that a user is who they claim to be, while authorization is verifying which resources the user has access to.

\n

Authentication always comes first before authorization since you first need to identify the user before determining what level of access to give them.

\n

You can either choose to implement your own authentication strategy or leverage the benefits of a third-party identity platform. A do-it-yourself solution is prone to security errors, takes up a lot of time, and can increase the complexity of your application.

\n

With a third-party solution, you get access to multiple authentication methods, advanced security features, and you write less code.

\n

User Authentication with LoginRadius

\n

LoginRadius is a no-code identity platform offering authentication, authorization, account security, and privacy solutions.

\n

The Authentication API provided by LoginRadius allows you to authenticate a user using an email and a password. Once the user is verified, LoginRadius responds with an access token. The user will, in turn, use the access token to send requests to protected endpoints.

\n

User Authentication in NestJS

\n

NestJS is a Node.js framework built on Express.js with an Angular-like architectural structure. It is used to build scalable and modern server-side applications. The following sections will guide you in creating a simple NestJS application with authentication.

\n

Set Up the Project

\n

Create a new NestJS project by running the following commands

\n
// Install NestJS CLI\nnpm i -g @nestjs/cli\n\n// Create a new project\nnest new nest-loginradius-auth\n\ncd nest-loginradius-auth
\n

Set Up LoginRadius

\n

To authenticate a user using LoginRadius in NestJS, you need credentials: an API key and an API secret.

\n

Get your account credentials by creating a free LoginRadius account and head over to the dashboard.

\n

Create an app and select configuration and then get your app's credentials from the API credentials panel.

\n

Set Up .env file

\n

Since the API key and API secret from the LoginRadius dashboard are sensitive, you will store them in the .env file.

\n

You will need the dotenv module to access the your environment variables. Run the following command to install it.

\n
npm install dotenv
\n

Add the API key, API secret, and Secure One Time Token(SOTT) to the.env file.

\n
APP_NAME=<your app name>\nAPI_KEY=<your api key>\nAPI_SECRET=<your api secret>\nSOTT= <your sott>
\n

Authentication Flow

\n

In this project, you will be authenticating the user using their email and password. The following are the major steps you will be following:

\n\n

Create an Authentication Module

\n

Generate an auth module, controller, and service by running the following code.

\n
nest generate module auth\nnest generate controller auth
\n

Create a User

\n

To create a user, you need to create a signup route that will accept the email and password.

\n

Since you are using TypeScript, define the DTO (Data Transfer Object) schema to validate the user data passed in the request body.

\n

In the auth folder, add the dto folder and create a UserDTO class in the user.dto.ts file.

\n
export class UserDto {\n  email: string;\n  password: string;\n}
\n

Next, inside the AuthController, import the DTO to be used to validate the request body.

\n
import { Injectable } from '@nestjs/common';\nimport { UserDto } from './dto/user.dto';\n\n@Injectable()\n@Controller('auth')\nexport class AuthController {\n  @Post('signup')\n  async signup(@Body() registerUserDto: UserDto) {\n    // Register user\n  }\n}
\n

Generate Auth Service File

\n

A service file is used to abstract the business logic away from the controller. You will be handling the actual authentication and authorization process in this file.

\n

Generate a service for auth by running the following command.

\n
nest g service auth
\n

Next, populate the auth.service file by adding the signup method.

\n
import { Injectable } from '@nestjs/common';\nimport { UserDto } from './dto/user.dto';\nimport * as LRAuthPrrovider from 'loginradius-sdk'\n\n@Injectable()\nexport class AuthService {\n    async signup(registerUserDto: UserDto) {\n      console.log('sign up')\n    }\n}
\n

Note that you are also importing the user DTO and the loginradius-sdk at the top of the file.\nTo execute the signup method in the signup route, inject it in the auth.controller.ts file.

\n
import { Injectable } from '@nestjs/common';\nimport { UserDto } from './dto/user.dto';\nimport { AuthService } from './auth.service';\n\n@Injectable()\n@Controller('auth')\nexport class AuthController {\n  constructor(private readonly authService: AuthService) { }\n\n  @Post('signup')\n  async signup(@Body() registerUserDto: UserDto) {\n    let response = await this.authService.signup(registerUserDto)\n    return response\n  }\n}
\n

Before registering the user, validate if the email is already in use.\nFirst, install loginradius-sdk using the following command.

\n
npm i loginradius-sdk
\n

Next import loginradius-sdk and configure it and since you will be using variables from the .env file, remember to also configure dotenv.

\n
import * as dotenv from 'dotenv';\ndotenv.config()\nimport * as LRAuthPrrovider from 'loginradius-sdk'\n\nlet config = {\n    apiDomain: "api.loginradius.com",\n    apiKey: process.env.API_KEY,\n    apiSecret: process.env.API_SECRET,\n    siteName: process.env.APP_NAME,\n    apiRequestSigning: false,\n    proxy: {\n      host: "",\n      port: "",\n      user: "",\n      password: "",\n    },\n  };\nlet lrv2 = LRAuthPrrovider(config);\n\nlet sott = process.env.SOTT
\n

Next, check if the email is already in use.

\n
@Injectable()\nexport class AuthService {\n  async signup(registerUserDto: UserDto) {\n    try {\n      const response = await lrv2.authenticationApi\n        .checkEmailAvailability(registerUserDto.email)\n        if (response.isExist) {\n          return "Email already in use"\n        }\n    catch(error) {\n      return error\n    }\n  }\n}
\n

If the email is not already in use, register the user.

\n
@Injectable()\nexport class AuthService {\n    async signup(registerUserDto: UserDto) {\n      try {\n        // check if email is already in use\n        const response = await lrv2.authenticationApi\n            .checkEmailAvailability(registerUserDto.email)\n          if (response.isExist) {\n          return "Email already in use"\n          }\n          // create registration model\n          let authUserRegistrationModel = {\n            email: [\n              {\n                type: "primary",\n                value: registerUserDto.email,\n              },\n            ],\n            password: registerUserDto.password,\n          };\n          // register user\n          let user = await lrv2.authenticationApi\n          .userRegistrationByEmail(authUserRegistrationModel, sott)\n          if(user) {\n            return "Sign up successful"\n          }\n        } catch (error) {\n          return error\n        }\n    }\n}
\n

In the above code, you register a new user by passing in the user data to the authentication API. The authUserRegistrationModel object defines how the email and password will be stored in the database.

\n

Log In the User

\n

To log in the user, pass in the email and password to the authentication API of LoginRadius.

\n

In auth.service.ts, add the login function.

\n
@Injectable()\nexport class AuthService {\n    async signup(registerUserDto: UserDto) {\n        // register user\n    }\n    async login(loginUserDTO: UserDto) {\n        // login user\n    }\n}
\n

Since you are expecting the same type of data from the request body, i.e., the email and password, like in the signup route, you can reuse the user DTO.

\n

Next, add the login functionality.

\n
@Injectable()\nexport class AuthService {\n    async signup(registerUserDto: UserDto) {\n        // register user\n    }\n    async login(loginUserDTO: UserDto) {\n        try {\n            let emailAuthenticationModel = {\n                email: loginUserDTO.email,\n                password: loginUserDTO.password,\n              };\n            let user = await lrv2.authenticationApi\n                .loginByEmail(emailAuthenticationModel)\n            return {\n                accessToken: user.access_token,\n            }\n        } catch (error) {\n            return error\n        }\n    }\n}
\n

In the above code, you are logging in the user through loginradius-sdk. If successful, send back the accessToken in the response body. The user will use the access token to access protected routes.

\n

Inject the login method in the auth.controller.ts file to use it in the login route.

\n
import { Injectable } from '@nestjs/common';\nimport { UserDto } from './dto/user.dto';\nimport { AuthService } from './auth.service';\n\n@Injectable()\n@Controller('auth')\nexport class AuthController {\n  constructor(private readonly authService: AuthService) { }\n\n  @Post('signup')\n  async signup(@Body() registerUserDto: UserDto) {\n    // register user\n  }\n  async login(@Body() loginUserDto: UserDto) {\n    // login user\n  }\n}
\n

Access Protected Routes

\n

For protected routes, like accessing a user dashboard, the user will need to send the access token with the request. The access token will then be verified, and if valid, the application will be granted access.

\n

The user will need to store the accessToken. In this tutorial, you will be storing the token in the authorization header as a bearer token. Another alternative would be to use HTTP-only cookies.

\n

In NestJS, guards are responsible for handling authorization. They determine whether a request will be handled by the route.

\n

In auth.guard.ts, add the following code.

\n
import {AuthService } from './auth.service';\nimport { Request } from 'express';\n\n@Injectable()\nexport class AuthGuard implements CanActivate {\n\n    constructor(\n        private readonly authService: AuthService,\n    ) {}\n\n    async canActivate(context: ExecutionContext): Promise<boolean> {\n        const request: Request = context.switchToHttp().getRequest();\n\n        // Extract the access token from the authorization header\n        const authheader = request.header('Authorization');\n        const token = authheader && authheader.split(" ")[1];\n        try {\n            let authorizedMsg = await this.authService.authenticate(token);\n            // Attach the authorized message to the request. You could also attach the user information.\n            request['isAuthorized'] = "Authorized"\n            return true;\n        } catch (error) {\n            throw new UnauthorizedException();\n        }\n    }\n}
\n

In the above code, you define the auth guard that will be used to decorate the protected routes. The token is extracted from the request authorization header and passed to the authenticate method defined in AuthService. This method will be responsible for verifying the token.

\n

In auth.service.ts, create the authenticate method. This method will send the access token to LoginRadius for verification.

\n
import { Injectable, UnauthorizedException } from '@nestjs/common';\nimport { UserDto } from './dto/user.dto';\nimport * as LRAuthPrrovider from 'loginradius-sdk'\n\n@Injectable()\nexport class AuthService {\n    async signup(registerUserDto: UserDto) {\n      // signup user\n    }\n    async login(loginUserDTO: UserDto) {\n      // login user\n    }\n    async authenticate(accessToken: string) {\n        try {\n          const response = await lrv2.authenticationApi\n            .authValidateAccessToken(accessToken)\n          return response\n        } catch (error) {\n          throw new UnauthorizedException();\n        }\n    }\n}
\n

Now, create a protected route. In auth.controller.ts, add the following.

\n
import { Controller, Get, Body, Post, UseGuards } from '@nestjs/common';\nimport { UserDto } from './dto/user.dto';\nimport { AuthService } from './auth.service';\nimport { AuthGuard } from './auth.guard';\n\n@Controller('auth')\nexport class AuthController {\n  constructor(private readonly authService: AuthService) { }\n\n  @Post('signup')\n  async signup(@Body() registerUserDto: UserDto) {\n    // signup user\n  }\n  @Post('login')\n  async login(@Body() loginUserDto: UserDto) {\n    // login user\n  }\n  @UseGuards(AuthGuard)\n  @Get('protected')\n  async protected() {\n    return "Access granted"\n  }\n}
\n

Now, every route you add UseGuards to will require a valid access token.

\n

Test with Postman

\n

Use Postman or any other REST client of your choice to test the routes you have created.

\n

First, create a test user by sending a POST request to the signup endpoint. Remember to include the email and password of the user in the request body.

\n
POST http://localhost:3000/auth/signup
\n

You should receive a \"Sign up successful\" message if the request is successful.

\n

\n \n \n

\n

Conclusion

\n

In this tutorial, you have learned how to implement NestJS authentication using the LoginRadius Authentication API. You have seen how to log in a user and use an access token to protect specific routes.

\n

You can find the source code used in this tutorial on Github.

\n

Learn more about the LoginRadius Authentication API from the documentation files. It has more identity management features than discussed in this tutorial. You can use these features to further enhance authentication as you need in your NestJS projects.

\n","headings":[{"value":"Authentication vs. Authorization","depth":2},{"value":"User Authentication with LoginRadius","depth":2},{"value":"User Authentication in NestJS","depth":2},{"value":"Set Up the Project","depth":2},{"value":"Set Up LoginRadius","depth":2},{"value":"Set Up .env file","depth":2},{"value":"Authentication Flow","depth":2},{"value":"Create an Authentication Module","depth":2},{"value":"Create a User","depth":2},{"value":"Generate Auth Service File","depth":3},{"value":"Log In the User","depth":2},{"value":"Access Protected Routes","depth":2},{"value":"Test with Postman","depth":2},{"value":"Conclusion","depth":2}],"fields":{"slug":"/engineering/guest-post/nestjs-authentication-with-loginradius-api/"},"frontmatter":{"metatitle":null,"metadescription":null,"description":"Want to authenticate users on your NestJS app? Follow this tutorial to learn how to authenticate users using a password and perform authorization using access tokens.","title":"NestJS User Authentication with LoginRadius API","canonical":null,"date":"March 23, 2022","updated_date":null,"tags":["NestJS","Node.js","Authentication"],"coverImage":{"childImageSharp":{"fluid":{"aspectRatio":1.5037593984962405,"src":"/static/5822d69cb631f40002905e1a880e64d4/03979/coverimage.png","srcSet":"/static/5822d69cb631f40002905e1a880e64d4/f5f11/coverimage.png 200w,\n/static/5822d69cb631f40002905e1a880e64d4/6d133/coverimage.png 400w,\n/static/5822d69cb631f40002905e1a880e64d4/03979/coverimage.png 800w,\n/static/5822d69cb631f40002905e1a880e64d4/aca38/coverimage.png 1200w","sizes":"(max-width: 800px) 100vw, 800px"}}},"author":{"id":"Mary Gathoni","github":null,"bio":"She is a software developer with a passion for technical writing. She strives to create content that is educative and easily understandable. In her free time, she enjoys being outdoors with friends.","avatar":null}}}},"pageContext":{"id":"9ea233d4-d281-51da-aa88-fb8b677e538d","fields__slug":"/engineering/guest-post/nestjs-authentication-with-loginradius-api/","__params":{"fields__slug":"engineering"}}},"staticQueryHashes":["1171199041","1384082988","1711371485","1753898100","2100481360","229320306","23180105","528864852"]}