{"componentChunkName":"component---src-pages-markdown-remark-fields-slug-js","path":"/engineering/guest-post/session-authentication-with-nestjs-and-mongodb/","result":{"data":{"markdownRemark":{"id":"2a0e31c4-9333-5865-826d-7c7ee2516434","excerpt":"Introduction It is an indisputable reality that authentication is critical in any application or system if you want to secure user data and enable secure access…","html":"

Introduction

\n

It is an indisputable reality that authentication is critical in any application or system if you want to secure user data and enable secure access to information. Authentication is the procedure of establishing or demonstrating that something is true, legitimate, or valid.

\n

Prerequisites

\n

This tutorial is a hands-on demonstration. To follow along, ensure you have the following in place:

\n\n

What is NestJS?

\n

Nest (NestJS) is a Node.js server-side application framework for building scalable, efficient applications.

\n

It is written in TypeScript and built on Express, a very minimalistic framework that is great on its own but lacks structure. It combines programming paradigms such as object-oriented programming, functional programming, and functional reactive programming.

\n

It is a framework to use if you want a lot of structure on your backend. Its syntax and structure are very similar to AngularJS, a front-end framework. And it uses TypeScript, services, and dependency injection in the same way that AngularJS does.

\n

It employs modules and controllers, and you can build controllers for a file using the command-line interface.

\n

NestJS modules allow you to group related controllers and service providers into a single code file. Simply put, a NestJS module is a TypeScript file with the @Module annotation (). This decorator informs the NestJS framework about which controllers, service providers, and other associated resources will be instantiated and used by the app code later.

\n

What is Session-based Authentication?

\n

Session-based authentication is a method of user authentication in which the server creates a session after a successful log-in, with the session ID stored in a cookie or local storage in your browser.

\n

Upon subsequent requests, your cookie is validated against the session ID stored on the server. If there is a match, the request is considered valid and processed.

\n

When using this authentication method, it is critical to keep the following security best practices in mind:

\n\n

Why Session-based Authentication?

\n

Session-based authentication is more secure than most authentication methods because it is simple, secure, and has a limited storage size. It is also thought to be the best option for websites in the same root domain.

\n

Project Setup

\n

Start your project setup by installing Nest CLI globally. You don’t need to do this if you already have NestJS CLI installed.

\n

The Nest CLI is a command-line interface tool for setting up, developing, and maintaining Nest applications.

\n
npm i -g @nestjs/cli
\n

Now, let’s set up your project by running the following command:

\n
nest new session-based-auth
\n

The above command creates a Nest application with some boilerplates, then prompts you to choose your preferred package manager to install the required modules to run your application. For demonstration, this tutorial uses npm. Hit the enter key to continue with npm.

\n

\n \n

npm install --save @nestjs/passport passport passport-local
\n

The above command installs Passport.js, a popular nest.js authentication library.

\n

Also, install the types for the strategy with the command below:

\n

It contains type definitions for passport-local.

\n
npm install --save-dev @types/passport-local
\n

Set Up MongoDB Database in NestJS

\n

To set up and connect your database, install the Mongoose package and the NestJS wrapper with the following command:

\n
npm install --save @nestjs/mongoose mongoose
\n

The Mongoose NestJS wrapper helps you use Mongoose in the NestJS application and gives approved TypeScript support.

\n

Now, head over to your app.module.ts, and import the mongoose module from @nestjs/mongoose. Then call the forRoot() method, a method provided by the Mongoose module, and pass in your database URL string.

\n

Setting up your database connection in app.module.ts helps your application connect to the database immediately as the server starts — after running your application since it’s the first module to be loaded.

\n

app.module.ts

\n
import { Module } from "@nestjs/common"\nimport { MongooseModule } from "@nestjs/mongoose"\nimport { AppController } from "./app.controller"\nimport { AppService } from "./app.service"\n\n@Module({\n  imports: [\n    MongooseModule.forRoot(\n      "mongodb+srv://<username>:<password>@cluster0.kngtf.mongodb.net/session-auth?retryWrites=true&w=majority"\n    ),\n  ],\n  controllers: [AppController],\n  providers: [AppService],\n})\nexport class AppModule {}
\n

Create Users Module

\n

For separation concerns, to make your code clean and well organized, create a module specifically for users using the NestJS CLI by running the following command:

\n
nest g module users
\n

The above command creates a users folder with users.module.ts and updates app.module.ts

\n

Also, create users.service.ts and users.controller.ts files with the following commands:

\n
nest g service users\nnest g controller users
\n

Note that you can create your folders and files manually without using the nest CLI, but using the CLI automatically updates the necessary folders and makes your life easier.

\n

Create User Schema

\n

The next step is to create your UserSchema, but first, add a users.model.ts file, where you will create UserSchema

\n

This should be the shape of our application src folder now.

\n
└───src\n│   └───users\n│   │   └───users.controller.ts\n│   │   └───users.model.ts\n│   │   └───users.module.ts\n│   │   └───users.service.ts\n│   └───app.controller.ts\n│   └───app.module.ts\n│   └───app.service.ts\n│   └───main.ts
\n

To create UserSchema, import everything as mongoose from the mongoose package in users.model.ts. Then call the new mongoose schema, a blueprint of the user Model, and pass in a JavaScript object where you will define the user object and data.

\n

users.model.ts

\n
import * as mongoose from "mongoose"\nexport const UserSchema = new mongoose.Schema(\n  {\n    username: {\n      type: String,\n      required: true,\n      unique: true,\n    },\n    password: {\n      type: String,\n      required: true,\n    },\n  },\n  { timestamps: true }\n)\n\nexport interface User extends mongoose.Document {\n  _id: string;\n  username: string;\n  password: string;\n}
\n

Also, create an interface for your Model that extends mongoose, a document that helps you populate your MongoDB collections.

\n

Head over to your users.module.ts and import MongooseModule in the imports array. Then call the forFeature() method provided by MongooseModule, and pass in an array of object that takes in name and schema.

\n

This will enable you to share the file anywhere with the help of dependency injection.

\n

users.module.ts

\n
import { Module } from "@nestjs/common"\nimport { MongooseModule } from "@nestjs/mongoose"\nimport { UsersController } from "./users.controller"\nimport { UserSchema } from "./users.model"\nimport { UsersService } from "./users.service"\n@Module({\n  imports: [MongooseModule.forFeature([{ name: "user", schema: UserSchema }])],\n  controllers: [UsersController],\n  providers: [UsersService],\n})\nexport class UsersModule {}
\n

In users.module.ts, export the UsersService to enable you to access it in another module.

\n

users.module.ts

\n
import { Module } from "@nestjs/common"\nimport { MongooseModule } from "@nestjs/mongoose"\nimport { UsersController } from "./users.controller"\nimport { UserSchema } from "./users.model"\nimport { UsersService } from "./users.service"\n@Module({\n  imports: [MongooseModule.forFeature([{ name: "user", schema: UserSchema }])],\n  controllers: [UsersController],\n  providers: [UsersService],\n  exports: [UsersService],\n})\nexport class UsersModule {}
\n

It's usually a good idea to encapsulate the business logic in a separate class. Such a class is known as a service. The job of this class is to process the controller's requests and perform the business logic.

\n

In users.service.ts file, import Model from mongoose, User from users.model.ts, and InjectModel from @nestjs/mongoose. Then add a method to the UsersService class that takes a username and password, and call the method insertUser().

\n

users.service.ts

\n
import { Injectable } from '@nestjs/common';\nimport { InjectModel } from '@nestjs/mongoose';\nimport { Model } from 'mongoose';\nimport { User } from './users.model';\n@Injectable()\nexport class UsersService {\n  constructor(@InjectModel('user') private readonly userModel: Model<User>) {}\n  async insertUser(userName: string, password: string) {\n    const username = userName.toLowerCase();\n    const newUser = new this.userModel({\n      username,\n      password,\n    });\n    await newUser.save();\n    return newUser;\n  }\n}
\n

Now that the UsersService class is ready, you need to inject it into your controller. But first, let's talk about storing the users' passwords securely.

\n

The most critical aspect of the registration procedure is the users’ passwords, which must not be saved in plain text. It is the responsibility of the user to create a strong password, but it is your obligation as a developer to keep their passwords secure. If a database breach occurs, the users' passwords would be exposed. And what happens if it’s stored in plain text? I believe you know the answer. To address this, hash the passwords using bcrypt.

\n

So, install bcrypt and @types/bcrypt with the following command:

\n
npm install @types/bcrypt bcrypt
\n

With that out of the way, set up your controller. First, import your UsersService class and everything from bcrypt. Then add a constructor and a method that allows you to add a user; it will handle incoming post requests, call it addUser, with a function body where you'll hash the password.

\n

users.controller.ts

\n
import { Body, Controller, Post } from '@nestjs/common';\nimport { UsersService } from './users.service';\nimport * as bcrypt from 'bcrypt';\n@Controller('users')\nexport class UsersController {\n  constructor(private readonly usersService: UsersService) {}\n  //post / signup\n  @Post('/signup')\n  async addUser(\n    @Body('password') userPassword: string,\n    @Body('username') userName: string,\n  ) {\n    const saltOrRounds = 10;\n    const hashedPassword = await bcrypt.hash(userPassword, saltOrRounds);\n    const result = await this.usersService.insertUser(\n      userName,\n      hashedPassword,\n    );\n    return {\n      msg: 'User successfully registered',\n      userId: result.id,\n      userName: result.username\n    };\n  }\n}
\n

The registration happens in the app.module.ts file, which is achieved by adding the UsersModule to the @Module() decorator's imports' array in app.module.ts.

\n

app.module.ts

\n
import { Module } from "@nestjs/common"\nimport { MongooseModule } from "@nestjs/mongoose"\nimport { AppController } from "./app.controller"\nimport { AppService } from "./app.service"\nimport { UsersModule } from "./users/users.module"\n\n@Module({\n  imports: [\n    MongooseModule.forRoot(\n      "mongodb+srv://<username>:<password>@cluster0.kngtf.mongodb.net/session-auth?retryWrites=true&w=majority"\n    ),\n    UsersModule,\n  ],\n  controllers: [AppController],\n  providers: [AppService],\n})\nexport class AppModule {}
\n

Congratulations! You are done with the registration. You can now register a user with a username and password.

\n

Now, with registration out of the way, add a getUser function to your UsersService with the findOne method to find a user by username.

\n

users.service.ts

\n
import { Injectable } from '@nestjs/common';\nimport { InjectModel } from '@nestjs/mongoose';\nimport { Model } from 'mongoose';\nimport { User } from './users.model';\n@Injectable()\nexport class UsersService {\n  constructor(@InjectModel('user') private readonly userModel: Model<User>) {}\n  async insertUser(userName: string, password: string) {\n    const username = userName.toLowerCase();\n    const newUser = new this.userModel({\n      username,\n      password,\n    });\n    await newUser.save();\n    return newUser;\n  }\n  async getUser(userName: string) {\n    const username = userName.toLowerCase();\n    const user = await this.userModel.findOne({ username });\n    return user;\n  }\n}
\n

Create Authentication Module

\n

Just as for users, create an auth module and service specifically for all the authentications/verifications. To do that, run the following commands:

\n
nest g module auth\nnest g service auth
\n

The above will create an auth folder, auth.module.ts, and auth.service.ts, and update the auth.module.ts and app.module.ts files.

\n

At this point, the shape of your application src folder should look as follows.

\n
└───src\n│   └───auth\n│   │   └───auth.module.ts\n│   │   └───auth.service.ts\n│   └───users\n│   │   └───users.controller.ts\n│   │   └───users.model.ts\n│   │   └───users.module.ts\n│   │   └───users.service.ts\n│   └───app.controller.ts\n│   └───app.module.ts\n│   └───app.service.ts\n│   └───main.ts
\n

The above generate command will update your app.module.ts, and it will look like the code snippet below:

\n

app.module.ts

\n
import { Module } from "@nestjs/common"\nimport { MongooseModule } from "@nestjs/mongoose"\nimport { AppController } from "./app.controller"\nimport { AppService } from "./app.service"\nimport { UsersModule } from "./users/users.module"\nimport { AuthModule } from './auth/auth.module';\n\n\n@Module({\n  imports: [UsersModule, AuthModule, MongooseModule.forRoot(\n    //database url string\n    'mongodb://localhost:27017/myapp'\n    )],\n  controllers: [AppController],\n  providers: [AppService],\n})\nexport class AppModule {}
\n

Authenticate Users

\n

Go to your auth.module.ts file and add UsersModule in the imports array to enable access to the UsersService exported from the users.module.ts file.

\n

auth.module.ts

\n
import { Module } from "@nestjs/common"\nimport { UsersModule } from "src/users/users.module"\nimport { AuthService } from "./auth.service"\n\n@Module({\n  imports: [UsersModule],\n  providers: [AuthService],\n})\nexport class AuthModule {}
\n

In your auth.service.ts file, call the constructor so you can inject the UsersService, and add a method for validation that will take a username and password.

\n

To add some basic validations, check if the user exists in the database, and compare the given password with the one in your database to ensure it matches. If it exists, return the user in the request.user object — else, return null.

\n

auth.service.ts

\n
    import { Injectable, NotAcceptableException } from '@nestjs/common';\n    import { UsersService } from 'src/users/users.service';\n    import * as bcrypt from 'bcrypt';\n\n    @Injectable()\n    export class AuthService {\n      constructor(private readonly usersService: UsersService) {}\n      async validateUser(username: string, password: string): Promise<any> {\n        const user = await this.usersService.getUser(username);\n        const passwordValid = await bcrypt.compare(password, user.password)\n        if (!user) {\n            throw new NotAcceptableException('could not find the user');\n          }\n        if (user && passwordValid) {\n          return {\n            userId: user.id,\n            userName: user.username\n          };\n        }\n        return null;\n      }\n    }
\n

Going further, create a new file and name it local.strategy.ts. This file will represent the strategy from Passport.js, which you installed earlier, that is the local strategy. And within it, pass in the strategy, which is the Strategy from passport-local.

\n

Create a constructor and inject the AuthService, call the super() method; ensure to call the super() method.

\n

local.strategy.ts

\n
    import { Injectable, UnauthorizedException } from '@nestjs/common';\n    import { PassportStrategy } from '@nestjs/passport';\n    import { Strategy } from 'passport-local';\n    import { AuthService } from './auth.service';\n    @Injectable()\n    export class LocalStrategy extends PassportStrategy(Strategy) {\n      constructor(private readonly authService: AuthService) {\n        super();\n      }\n      async validate(username: string, password: string): Promise<any> {\n        const userName = username.toLowerCase();\n        const user = await this.authService.validateUser(userName, password);\n        if (!user) {\n          throw new UnauthorizedException();\n        }\n        return user;\n      }\n    }
\n

Go back to your auth.module.ts file. Then add PassportModule to imports and LocalStrategy to providers.

\n

auth.module.ts

\n
import { Module } from "@nestjs/common"\nimport { PassportModule } from "@nestjs/passport"\nimport { UsersModule } from "src/users/users.module"\nimport { AuthService } from "./auth.service"\nimport { LocalStrategy } from "./local.strategy"\n\n@Module({\n  imports: [UsersModule, PassportModule],\n  providers: [AuthService, LocalStrategy],\n})\nexport class AuthModule {}
\n

Now, add the login route to your users.controller.ts:

\n

users.controller.ts

\n
    import {\n      Body,\n      Controller,\n      Post,\n      Request,\n    } from '@nestjs/common';\n    import * as bcrypt from 'bcrypt';\n    import { UsersService } from './users.service';\n    @Controller('users')\n    export class UsersController {\n      constructor(private readonly usersService: UsersService) {}\n      //post / signup\n      @Post('/signup')\n      async addUser(\n        @Body('password') userPassword: string,\n        @Body('username') userName: string,\n      ) {\n        const saltOrRounds = 10;\n        const hashedPassword = await bcrypt.hash(userPassword, saltOrRounds);\n        const result = await this.usersService.insertUser(\n          userName,\n          hashedPassword,\n        );\n        return {\n          msg: 'User successfully registered',\n          userId: result.id,\n          userName: result.username\n        };\n      }\n      //Post / Login\n      @Post('/login')\n      login(@Request() req): any {\n        return {User: req.user,\n                msg: 'User logged in'};\n      }\n    }
\n

Now that you have all these put in place, you still cannot log in a user because there is nothing to trigger the login route. Here, use Guards to achieve that.

\n

Create a file and name it local.auth.guard.ts, then a class LocalAuthGuard that extends AuthGuard from NestJS/passport, where you will provide the name of the strategy and pass in the name of your strategy, local.

\n

local.auth.guard.ts.

\n
import { Injectable } from "@nestjs/common"\nimport { AuthGuard } from "@nestjs/passport"\n@Injectable()\nexport class LocalAuthGuard extends AuthGuard("local") {}
\n

Add the UseGuard decorator to your login route in the users.controller.ts file, and pass in the LocalAuthGuard.

\n

users.controller.ts

\n
    import {\n      Body,\n      Controller,\n      Post,\n      UseGuards,\n      Request,\n    } from '@nestjs/common';\n    import * as bcrypt from 'bcrypt';\n    import { LocalAuthGuard } from 'src/auth/local.auth.guard';\n    import { UsersService } from './users.service';\n    @Controller('users')\n    export class UsersController {\n      constructor(private readonly usersService: UsersService) {}\n      //post / signup\n      @Post('/signup')\n      async addUser(\n        @Body('password') userPassword: string,\n        @Body('username') userName: string,\n      ) {\n        const saltOrRounds = 10;\n        const hashedPassword = await bcrypt.hash(userPassword, saltOrRounds);\n        const result = await this.usersService.insertUser(\n          userName,\n          hashedPassword,\n        );\n        return {\n          msg: 'User successfully registered',\n          userId: result.id,\n          userName: result.username\n        };\n      }\n      //Post / Login\n      @UseGuards(LocalAuthGuard)\n      @Post('/login')\n      login(@Request() req): any {\n        return {User: req.user,\n                msg: 'User logged in'};\n      }\n    }
\n

Finally, you can log in a user with a registered username and password.

\n

Protect Authentication Routes

\n

You have successfully set up user authentication. Now, protect your routes from unauthorized access by limiting access to just authenticated users. Go to your users.controller.ts file, and add another route — name it ‘protected’ and make it return the req.user object.

\n

users.controller.ts

\n
    import {\n      Body,\n      Controller,\n      Get,\n      Post,\n      UseGuards,\n      Request,\n    } from '@nestjs/common';\n    import * as bcrypt from 'bcrypt';\n    import { LocalAuthGuard } from 'src/auth/local.auth.guard';\n    import { UsersService } from './users.service';\n    @Controller('users')\n    export class UsersController {\n      constructor(private readonly usersService: UsersService) {}\n      //signup\n      @Post('/signup')\n      async addUser(\n        @Body('password') userPassword: string,\n        @Body('username') userName: string,\n      ) {\n        const saltOrRounds = 10;\n        const hashedPassword = await bcrypt.hash(userPassword, saltOrRounds);\n        const result = await this.usersService.insertUser(\n          userName,\n          hashedPassword,\n        );\n        return {\n          msg: 'User successfully registered',\n          userId: result.id,\n          userName: result.username\n        };\n      }\n      //Post / Login\n      @UseGuards(LocalAuthGuard)\n      @Post('/login')\n      login(@Request() req): any {\n        return {User: req.user,\n                msg: 'User logged in'};\n      }\n    // Get / protected\n      @Get('/protected')\n      getHello(@Request() req): string {\n        return req.user;\n      }\n    }
\n

The protected route in the above code will return an empty object instead of returning the user’s details when a logged-in user makes a request to it because it already lost the login.

\n

To get that sorted, this is where the session-based authentication comes in.

\n

In session-based authentication, when a user logs in, the user is saved in a session so that any subsequent request by the user after login will grab the details from the session and grant the user easy access. The session expires when the user logs out.

\n

To start session-based auth, install express-session and the NestJS types using the following command:

\n
npm install express-session @types/express-session
\n

When the installation is completed, go to your main.ts file, the root of your application, and do the configurations there.

\n

Import everything from passport and express-session, then add passport initialize and passport session.

\n

It is preferable to keep your secret key in your environment variables.

\n

main.ts

\n
import { NestFactory } from "@nestjs/core"\nimport { AppModule } from "./app.module"\nimport * as session from "express-session"\nimport * as passport from "passport"\nasync function bootstrap() {\n  const app = await NestFactory.create(AppModule)\n  app.use(\n    session({\n      secret: "keyboard",\n      resave: false,\n      saveUninitialized: false,\n    })\n  )\n  app.use(passport.initialize())\n  app.use(passport.session())\n\n  await app.listen(3000)\n}\nbootstrap()
\n

Add a new file, authenticated.guard.ts, in your auth folder. And create a new Guard that checks if there is a session for the user making the request — name it authenticatedGuard.

\n

authenticated.guard.ts

\n
import { CanActivate, ExecutionContext, Injectable } from "@nestjs/common"\n\n@Injectable()\nexport class AuthenticatedGuard implements CanActivate {\n  async canActivate(context: ExecutionContext) {\n    const request = context.switchToHttp().getRequest()\n    return request.isAuthenticated()\n  }\n}
\n

In the above code, the request is gotten from the context and checked if authenticated. isAuthenticated() comes from passport.js automatically; it says. \"hey! does a session exist for this user? If so, keep going.\"

\n

To trigger the login, in your users.controller.ts file:

\n\n

users.controller.ts

\n
    import {\n      Body,\n      Controller,\n      Get,\n      Post,\n      UseGuards,\n      Request,\n    } from '@nestjs/common';\n    import * as bcrypt from 'bcrypt';\n    import { AuthenticatedGuard } from 'src/auth/authenticated.guard';\n    import { LocalAuthGuard } from 'src/auth/local.auth.guard';\n    import { UsersService } from './users.service';\n    @Controller('users')\n    export class UsersController {\n      constructor(private readonly usersService: UsersService) {}\n      //signup\n      @Post('/signup')\n      async addUser(\n        @Body('password') userPassword: string,\n        @Body('username') userName: string,\n      ) {\n        const saltOrRounds = 10;\n        const hashedPassword = await bcrypt.hash(userPassword, saltOrRounds);\n        const result = await this.usersService.insertUser(\n          userName,\n          hashedPassword,\n        );\n        return {\n          msg: 'User successfully registered',\n          userId: result.id,\n          userName: result.username\n        };\n      }\n      //Post / Login\n      @UseGuards(LocalAuthGuard)\n      @Post('/login')\n      login(@Request() req): any {\n        return {User: req.user,\n                msg: 'User logged in'};\n      }\n      //Get / protected\n      @UseGuards(AuthenticatedGuard)\n      @Get('/protected')\n      getHello(@Request() req): string {\n        return req.user;\n      }\n    }
\n

At this point, it still fails because you've only configured express-session but didn't implement it.

\n

When a user logs in, you need to save the user in a session so that the user can access other routes with the session.

\n

One thing to keep in mind is that by default, the express-session library stores the session in the web server's memory.

\n

Before it goes into the session, you need to serialize the user. As it comes out of the session, deserialize the user.

\n

So, create a new file in the auth folder for serializer and deserializer, name it session.serializer.ts.

\n

At this point, the shape of our application src folder should look like this.

\n
    └───src\n    │   └───auth\n    │   │   └───auth.module.ts\n    │   │   └───auth.service.ts\n    │   │   └───authenticated.guard.ts\n    │   │   └───local.auth.guard.ts\n    │   │   └───local.strategy.ts\n    │   │   └───session.serializer.ts\n    │   └───users\n    │   │   └───users.controller.ts\n    │   │   └───users.model.ts\n    │   │   └───users.module.ts\n    │   │   └───users.service.ts\n    │   └───app.controller.ts\n    │   └───app.module.ts\n    │   └───app.service.ts\n    │   └───main.ts
\n

session.serializer.ts

\n
import { Injectable } from "@nestjs/common"\nimport { PassportSerializer } from "@nestjs/passport"\n\n@Injectable()\nexport class SessionSerializer extends PassportSerializer {\n  serializeUser(user: any, done: (err: Error, user: any) => void): any {\n    done(null, user)\n  }\n  deserializeUser(\n    payload: any,\n    done: (err: Error, payload: string) => void\n  ): any {\n    done(null, payload)\n  }\n}
\n

Go back to your auth.module.ts file, provide the SessionSerializer, and add the register method to the PassportModule.

\n

auth.module.ts

\n
import { Module } from "@nestjs/common"\nimport { PassportModule } from "@nestjs/passport"\nimport { UsersModule } from "src/users/users.module"\nimport { AuthService } from "./auth.service"\nimport { LocalStrategy } from "./local.strategy"\nimport { SessionSerializer } from "./session.serializer"\n\n@Module({\n  imports: [UsersModule, PassportModule.register({ session: true })],\n  providers: [AuthService, LocalStrategy, SessionSerializer],\n})\nexport class AuthModule {}
\n

Add some codes within the LocalAuthGuard in the local.auth.guard.ts file.

\n

Call the login method in super and pass in the request to trigger the actual login by creating a session. If you want to use sessions, you must remember to trigger the super.login().

\n

local.auth.guard.ts

\n
    import { ExecutionContext, Injectable } from '@nestjs/common';\n    import { AuthGuard } from '@nestjs/passport';\n    @Injectable()\n    export class LocalAuthGuard extends AuthGuard('local') {\n      async canActivate(context: ExecutionContext) {\n        const result = (await super.canActivate(context)) as boolean;\n        const request = context.switchToHttp().getRequest();\n        await super.logIn(request);\n        return result;\n      }\n    }
\n

If you log in now, you will see the session ID stored in a cookie, which is just a key to the session store, and the cookie gets saved in the browser. The cookie is automatically attached to the rest of the request.

\n

Now that the session is working, you can access the protected route; it will return the expected user’s details.

\n

Logout Users

\n

As mentioned earlier, once a user logs out, you destroy all sessions.

\n

To log out a user, go to the users.controller.ts file, add a logout route, and call the req.session.session() method. You can return a message notifying that the user’s session has ended.

\n
    import {\n      Body,\n      Controller,\n      Get,\n      Post,\n      UseGuards,\n      Request,\n    } from '@nestjs/common';\n    import * as bcrypt from 'bcrypt';\n    import { AuthenticatedGuard } from 'src/auth/authenticated.guard';\n    import { LocalAuthGuard } from 'src/auth/local.auth.guard';\n    import { UsersService } from './users.service';\n    @Controller('users')\n    export class UsersController {\n      constructor(private readonly usersService: UsersService) {}\n      //signup\n      @Post('/signup')\n      async addUser(\n        @Body('password') userPassword: string,\n        @Body('username') userName: string,\n      ) {\n        const saltOrRounds = 10;\n        const hashedPassword = await bcrypt.hash(userPassword, saltOrRounds);\n        const result = await this.usersService.insertUser(\n          userName,\n          hashedPassword,\n        );\n        return {\n          msg: 'User successfully registered',\n          userId: result.id,\n          userName: result.username\n        };\n      }\n      //Post / Login\n      @UseGuards(LocalAuthGuard)\n      @Post('/login')\n      login(@Request() req): any {\n        return {User: req.user,\n                msg: 'User logged in'};\n      }\n       //Get / protected\n      @UseGuards(AuthenticatedGuard)\n      @Get('/protected')\n      getHello(@Request() req): string {\n        return req.user;\n      }\n       //Get / logout\n      @Get('/logout')\n        logout(@Request() req): any {\n          req.session.destroy();\n          return { msg: 'The user session has ended' }\n        }\n    }
\n

So, once you log out, it returns a message notifying you that the user session has ended. The code for this tutorial is hosted here on my Github repository.

\n

Test Your Application

\n

You have successfully implemented user signup, authentication, and protected the route to enable authorized access only.

\n

It’s time to test the application. If everything is in order, your server should be running. Else, restart your server with the following command:

\n
npm run start:dev
\n

Head over to your Postman. And let’s finally test our application.

\n

Sign Up As a User

\n

\n \n \n

\n

Log In As a User

\n

\n \n \n

\n\n

\n \n \n

\n

User Logout

\n

\n \n \n

\n

Alternatively, Implement User Authentication with LoginRadius

\n

LoginRadius provides a variety of registration and authentication services to assist you in better connecting with your consumers.

\n

On any web or mobile application, LoginRadius is the developer-friendly Identity Platform that delivers a complete set of APIs for authentication, identity verification, single sign-on, user management, and account protection capabilities like multi-factor authentication.

\n

To implement LoginRadius in your NestJS application, follow this tutorial: NestJS User Authentication with LoginRadius API.

\n

Conclusion

\n

Congratulations! In this tutorial, you've learned how to implement session-based authentication in a NestJS application with the MongoDB database. You've created and authenticated a user and protected your routes from unauthorized access.

\n

You can access the sample code used in this tutorial on GitHub.

\n
\n

Note: Session storage is saved by default in 'MemoryStore,' which is not intended for production use. So, while no external datastore is required for development, once in production, a data store such as Redis or another is suggested for stability and performance. You can learn more about session storage here.

\n
\n","headings":[{"value":"Introduction","depth":2},{"value":"Prerequisites","depth":2},{"value":"What is NestJS?","depth":2},{"value":"What is Session-based Authentication?","depth":2},{"value":"Why Session-based Authentication?","depth":2},{"value":"Project Setup","depth":2},{"value":"Install Dependencies","depth":2},{"value":"Set Up MongoDB Database in NestJS","depth":2},{"value":"Create Users Module","depth":2},{"value":"Create User Schema","depth":2},{"value":"Create Authentication Module","depth":2},{"value":"Authenticate Users","depth":2},{"value":"Protect Authentication Routes","depth":2},{"value":"Logout Users","depth":2},{"value":"Test Your Application","depth":2},{"value":"Sign Up As a User","depth":3},{"value":"Log In As a User","depth":3},{"value":"Logged-in User’s Cookie ID","depth":3},{"value":"Request the Protected Route","depth":3},{"value":"User Logout","depth":3},{"value":"Alternatively, Implement User Authentication with LoginRadius","depth":2},{"value":"Conclusion","depth":2}],"fields":{"slug":"/engineering/guest-post/session-authentication-with-nestjs-and-mongodb/"},"frontmatter":{"metatitle":null,"metadescription":null,"description":"Want to implement user authentication for your NestJS apps? Follow this tutorial to learn how you can implement session-based authentication for your NestJS apps along with MongoDB.","title":"NestJS: How to Implement Session-Based User Authentication","canonical":null,"date":"April 26, 2022","updated_date":null,"tags":["Authentication","NestJS","MongoDB","Node.js"],"coverImage":{"childImageSharp":{"fluid":{"aspectRatio":1.5037593984962405,"src":"/static/d28db627e3ed8b9cfc8febf39b1cefad/03979/session-based-authentication-in-nestjs.png","srcSet":"/static/d28db627e3ed8b9cfc8febf39b1cefad/f5f11/session-based-authentication-in-nestjs.png 200w,\n/static/d28db627e3ed8b9cfc8febf39b1cefad/6d133/session-based-authentication-in-nestjs.png 400w,\n/static/d28db627e3ed8b9cfc8febf39b1cefad/03979/session-based-authentication-in-nestjs.png 800w,\n/static/d28db627e3ed8b9cfc8febf39b1cefad/aca38/session-based-authentication-in-nestjs.png 1200w","sizes":"(max-width: 800px) 100vw, 800px"}}},"author":{"id":"Ekekenta Odionyenfe Clinton","github":"icode247","bio":"He is a full-stack web application developer, software engineer, and technical writer, currently living in Nigeria, Portharcourt. He has an HND in Computer Science from Federal Polytechnic Nekede. His primary focus and inspiration for his studies is web development. In his free time, he studies human psychology and writes technical tutorials.","avatar":null}}}},"pageContext":{"id":"2a0e31c4-9333-5865-826d-7c7ee2516434","fields__slug":"/engineering/guest-post/session-authentication-with-nestjs-and-mongodb/","__params":{"fields__slug":"engineering"}}},"staticQueryHashes":["1171199041","1384082988","1711371485","1753898100","2100481360","229320306","23180105","528864852"]}