It is an indisputable reality that authentication is critical in any application or system if you want to secure user data and enable secure access to information. Authentication is the procedure of establishing or demonstrating that something is true, legitimate, or valid.
\nThis tutorial is a hands-on demonstration. To follow along, ensure you have the following in place:
\n\nNest (NestJS) is a Node.js server-side application framework for building scalable, efficient applications.
\nIt is written in TypeScript and built on Express, a very minimalistic framework that is great on its own but lacks structure. It combines programming paradigms such as object-oriented programming, functional programming, and functional reactive programming.
\nIt is a framework to use if you want a lot of structure on your backend. Its syntax and structure are very similar to AngularJS, a front-end framework. And it uses TypeScript, services, and dependency injection in the same way that AngularJS does.
\nIt employs modules and controllers, and you can build controllers for a file using the command-line interface.
\nNestJS modules allow you to group related controllers and service providers into a single code file. Simply put, a NestJS module is a TypeScript file with the @Module annotation (). This decorator informs the NestJS framework about which controllers, service providers, and other associated resources will be instantiated and used by the app code later.
\nSession-based authentication is a method of user authentication in which the server creates a session after a successful log-in, with the session ID stored in a cookie or local storage in your browser.
\nUpon subsequent requests, your cookie is validated against the session ID stored on the server. If there is a match, the request is considered valid and processed.
\nWhen using this authentication method, it is critical to keep the following security best practices in mind:
\nSession-based authentication is more secure than most authentication methods because it is simple, secure, and has a limited storage size. It is also thought to be the best option for websites in the same root domain.
\nStart your project setup by installing Nest CLI globally. You don’t need to do this if you already have NestJS CLI installed.
\nThe Nest CLI is a command-line interface tool for setting up, developing, and maintaining Nest applications.
\nnpm i -g @nestjs/cliNow, let’s set up your project by running the following command:
\nnest new session-based-authThe above command creates a Nest application with some boilerplates, then prompts you to choose your preferred package manager to install the required modules to run your application. For demonstration, this tutorial uses npm. Hit the enter key to continue with npm.
\nThe above command installs Passport.js, a popular nest.js authentication library. Also, install the types for the strategy with the command below: It contains type definitions for To set up and connect your database, install the Mongoose package and the NestJS wrapper with the following command: The Mongoose NestJS wrapper helps you use Mongoose in the NestJS application and gives approved TypeScript support. Now, head over to your Setting up your database connection in For separation concerns, to make your code clean and well organized, create a module specifically for users using the NestJS CLI by running the following command: The above command creates a Also, create Note that you can create your folders and files manually without using the nest CLI, but using the CLI automatically updates the necessary folders and makes your life easier. The next step is to create your UserSchema, but first, add a This should be the shape of our application To create Also, create an interface for your Model that extends mongoose, a document that helps you populate your MongoDB collections. Head over to your This will enable you to share the file anywhere with the help of dependency injection. In It's usually a good idea to encapsulate the business logic in a separate class. Such a class is known as a service. The job of this class is to process the controller's requests and perform the business logic. In Now that the The most critical aspect of the registration procedure is the users’ passwords, which must not be saved in plain text. It is the responsibility of the user to create a strong password, but it is your obligation as a developer to keep their passwords secure. If a database breach occurs, the users' passwords would be exposed. And what happens if it’s stored in plain text? I believe you know the answer. To address this, hash the passwords using bcrypt. So, install With that out of the way, set up your controller. First, import your The registration happens in the Congratulations! You are done with the registration. You can now register a user with a username and password. Now, with registration out of the way, add a Just as for users, create an auth module and service specifically for all the authentications/verifications. To do that, run the following commands: The above will create an auth folder, At this point, the shape of your application The above generate command will update your Go to your In your To add some basic validations, check if the user exists in the database, and compare the given password with the one in your database to ensure it matches. If it exists, return the user in the Going further, create a new file and name it Create a constructor and inject the Go back to your Now, add the login route to your Now that you have all these put in place, you still cannot log in a user because there is nothing to trigger the login route. Here, use Guards to achieve that. Create a file and name it Add the Finally, you can log in a user with a registered username and password. You have successfully set up user authentication. Now, protect your routes from unauthorized access by limiting access to just authenticated users. Go to your The protected route in the above code will return an empty object instead of returning the user’s details when a logged-in user makes a request to it because it already lost the login. To get that sorted, this is where the session-based authentication comes in. In session-based authentication, when a user logs in, the user is saved in a session so that any subsequent request by the user after login will grab the details from the session and grant the user easy access. The session expires when the user logs out. To start session-based auth, install express-session and the NestJS types using the following command: When the installation is completed, go to your Import everything from It is preferable to keep your secret key in your environment variables. Add a new file, In the above code, the request is gotten from the context and checked if authenticated. To trigger the login, in your At this point, it still fails because you've only configured When a user logs in, you need to save the user in a session so that the user can access other routes with the session. One thing to keep in mind is that by default, the Before it goes into the session, you need to serialize the user. As it comes out of the session, deserialize the user. So, create a new file in the auth folder for serializer and deserializer, name it At this point, the shape of our application Go back to your Add some codes within the Call the If you log in now, you will see the session ID stored in a cookie, which is just a key to the session store, and the cookie gets saved in the browser. The cookie is automatically attached to the rest of the request. Now that the session is working, you can access the protected route; it will return the expected user’s details. As mentioned earlier, once a user logs out, you destroy all sessions. To log out a user, go to the So, once you log out, it returns a message notifying you that the user session has ended. The code for this tutorial is hosted here on my Github repository. You have successfully implemented user signup, authentication, and protected the route to enable authorized access only. It’s time to test the application. If everything is in order, your server should be running. Else, restart your server with the following command: Head over to your Postman. And let’s finally test our application. LoginRadius provides a variety of registration and authentication services to assist you in better connecting with your consumers. On any web or mobile application, LoginRadius is the developer-friendly Identity Platform that delivers a complete set of APIs for authentication, identity verification, single sign-on, user management, and account protection capabilities like multi-factor authentication. To implement LoginRadius in your NestJS application, follow this tutorial: NestJS User Authentication with LoginRadius API. Congratulations! In this tutorial, you've learned how to implement session-based authentication in a NestJS application with the MongoDB database. You've created and authenticated a user and protected your routes from unauthorized access. You can access the sample code used in this tutorial on GitHub. Note: Session storage is saved by default in 'MemoryStore,' which is not intended for production use. So, while no external datastore is required for development, once in production, a data store such as Redis or another is suggested for stability and performance. You can learn more about session storage here. To create secure applications, you need a way to authenticate and authorize your users. In this tutorial, you will learn to authenticate users in your NestJS apps using LoginRadius Authentication API. Authentication and authorization are often seen as similar concepts, but they are not. Authentication is the process of verifying that a user is who they claim to be, while authorization is verifying which resources the user has access to. Authentication always comes first before authorization since you first need to identify the user before determining what level of access to give them. You can either choose to implement your own authentication strategy or leverage the benefits of a third-party identity platform. A do-it-yourself solution is prone to security errors, takes up a lot of time, and can increase the complexity of your application. With a third-party solution, you get access to multiple authentication methods, advanced security features, and you write less code. LoginRadius is a no-code identity platform offering authentication, authorization, account security, and privacy solutions. The Authentication API provided by LoginRadius allows you to authenticate a user using an email and a password. Once the user is verified, LoginRadius responds with an access token. The user will, in turn, use the access token to send requests to protected endpoints. NestJS is a Node.js framework built on Express.js with an Angular-like architectural structure. It is used to build scalable and modern server-side applications. The following sections will guide you in creating a simple NestJS application with authentication. Create a new NestJS project by running the following commands To authenticate a user using LoginRadius in NestJS, you need credentials: an API key and an API secret. Get your account credentials by creating a free LoginRadius account and head over to the dashboard. Create an app and select configuration and then get your app's credentials from the API credentials panel. Since the API key and API secret from the LoginRadius dashboard are sensitive, you will store them in the You will need the dotenv module to access the your environment variables. Run the following command to install it. Add the API key, API secret, and Secure One Time Token(SOTT) to the.env file. In this project, you will be authenticating the user using their email and password. The following are the major steps you will be following: Generate an auth module, controller, and service by running the following code. To create a user, you need to create a signup route that will accept the email and password. Since you are using TypeScript, define the DTO (Data Transfer Object) schema to validate the user data passed in the request body. In the Next, inside the A service file is used to abstract the business logic away from the controller. You will be handling the actual authentication and authorization process in this file. Generate a service for auth by running the following command. Next, populate the auth.service file by adding the signup method. Note that you are also importing the user DTO and the loginradius-sdk at the top of the file.\nTo execute the signup method in the signup route, inject it in the Before registering the user, validate if the email is already in use.\nFirst, install Next import Next, check if the email is already in use. If the email is not already in use, register the user. In the above code, you register a new user by passing in the user data to the authentication API. The To log in the user, pass in the email and password to the authentication API of LoginRadius. In Since you are expecting the same type of data from the request body, i.e., the email and password, like in the signup route, you can reuse the user DTO. Next, add the login functionality. In the above code, you are logging in the user through loginradius-sdk. If successful, send back the Inject the login method in the For protected routes, like accessing a user dashboard, the user will need to send the access token with the request. The access token will then be verified, and if valid, the application will be granted access. The user will need to store the In NestJS, guards are responsible for handling authorization. They determine whether a request will be handled by the route. In In the above code, you define the auth guard that will be used to decorate the protected routes. The token is extracted from the request authorization header and passed to the In Now, create a protected route. In Now, every route you add Use Postman or any other REST client of your choice to test the routes you have created. First, create a test user by sending a POST request to the signup endpoint. Remember to include the email and password of the user in the request body. You should receive a \"Sign up successful\" message if the request is successful. In this tutorial, you have learned how to implement NestJS authentication using the LoginRadius Authentication API. You have seen how to log in a user and use an access token to protect specific routes. You can find the source code used in this tutorial on Github. Learn more about the LoginRadius Authentication API from the documentation files. It has more identity management features than discussed in this tutorial. You can use these features to further enhance authentication as you need in your NestJS projects.
\nnpm install --save @nestjs/passport passport passport-localpassport-local.
\nnpm install --save-dev @types/passport-localSet Up MongoDB Database in NestJS
\n
\nnpm install --save @nestjs/mongoose mongooseapp.module.ts, and import the mongoose module from @nestjs/mongoose. Then call the forRoot() method, a method provided by the Mongoose module, and pass in your database URL string.app.module.ts helps your application connect to the database immediately as the server starts — after running your application since it’s the first module to be loaded.app.module.ts
\nimport { Module } from "@nestjs/common"\nimport { MongooseModule } from "@nestjs/mongoose"\nimport { AppController } from "./app.controller"\nimport { AppService } from "./app.service"\n\n@Module({\n imports: [\n MongooseModule.forRoot(\n "mongodb+srv://<username>:<password>@cluster0.kngtf.mongodb.net/session-auth?retryWrites=true&w=majority"\n ),\n ],\n controllers: [AppController],\n providers: [AppService],\n})\nexport class AppModule {}Create Users Module
\n
\nnest g module usersusers folder with users.module.ts and updates app.module.tsusers.service.ts and users.controller.ts files with the following commands:
\nnest g service users\nnest g controller usersCreate User Schema
\nusers.model.ts file, where you will create UserSchemasrc folder now.
\n└───src\n│ └───users\n│ │ └───users.controller.ts\n│ │ └───users.model.ts\n│ │ └───users.module.ts\n│ │ └───users.service.ts\n│ └───app.controller.ts\n│ └───app.module.ts\n│ └───app.service.ts\n│ └───main.tsUserSchema, import everything as mongoose from the mongoose package in users.model.ts. Then call the new mongoose schema, a blueprint of the user Model, and pass in a JavaScript object where you will define the user object and data.users.model.ts
\nimport * as mongoose from "mongoose"\nexport const UserSchema = new mongoose.Schema(\n {\n username: {\n type: String,\n required: true,\n unique: true,\n },\n password: {\n type: String,\n required: true,\n },\n },\n { timestamps: true }\n)\n\nexport interface User extends mongoose.Document {\n _id: string;\n username: string;\n password: string;\n}users.module.ts and import MongooseModule in the imports array. Then call the forFeature() method provided by MongooseModule, and pass in an array of object that takes in name and schema.users.module.ts
\nimport { Module } from "@nestjs/common"\nimport { MongooseModule } from "@nestjs/mongoose"\nimport { UsersController } from "./users.controller"\nimport { UserSchema } from "./users.model"\nimport { UsersService } from "./users.service"\n@Module({\n imports: [MongooseModule.forFeature([{ name: "user", schema: UserSchema }])],\n controllers: [UsersController],\n providers: [UsersService],\n})\nexport class UsersModule {}users.module.ts, export the UsersService to enable you to access it in another module.users.module.ts
\nimport { Module } from "@nestjs/common"\nimport { MongooseModule } from "@nestjs/mongoose"\nimport { UsersController } from "./users.controller"\nimport { UserSchema } from "./users.model"\nimport { UsersService } from "./users.service"\n@Module({\n imports: [MongooseModule.forFeature([{ name: "user", schema: UserSchema }])],\n controllers: [UsersController],\n providers: [UsersService],\n exports: [UsersService],\n})\nexport class UsersModule {}users.service.ts file, import Model from mongoose, User from users.model.ts, and InjectModel from @nestjs/mongoose. Then add a method to the UsersService class that takes a username and password, and call the method insertUser().users.service.ts
\nimport { Injectable } from '@nestjs/common';\nimport { InjectModel } from '@nestjs/mongoose';\nimport { Model } from 'mongoose';\nimport { User } from './users.model';\n@Injectable()\nexport class UsersService {\n constructor(@InjectModel('user') private readonly userModel: Model<User>) {}\n async insertUser(userName: string, password: string) {\n const username = userName.toLowerCase();\n const newUser = new this.userModel({\n username,\n password,\n });\n await newUser.save();\n return newUser;\n }\n}UsersService class is ready, you need to inject it into your controller. But first, let's talk about storing the users' passwords securely.bcrypt and @types/bcrypt with the following command:
\nnpm install @types/bcrypt bcryptUsersService class and everything from bcrypt. Then add a constructor and a method that allows you to add a user; it will handle incoming post requests, call it addUser, with a function body where you'll hash the password.users.controller.ts
\nimport { Body, Controller, Post } from '@nestjs/common';\nimport { UsersService } from './users.service';\nimport * as bcrypt from 'bcrypt';\n@Controller('users')\nexport class UsersController {\n constructor(private readonly usersService: UsersService) {}\n //post / signup\n @Post('/signup')\n async addUser(\n @Body('password') userPassword: string,\n @Body('username') userName: string,\n ) {\n const saltOrRounds = 10;\n const hashedPassword = await bcrypt.hash(userPassword, saltOrRounds);\n const result = await this.usersService.insertUser(\n userName,\n hashedPassword,\n );\n return {\n msg: 'User successfully registered',\n userId: result.id,\n userName: result.username\n };\n }\n}app.module.ts file, which is achieved by adding the UsersModule to the @Module() decorator's imports' array in app.module.ts.app.module.ts
\nimport { Module } from "@nestjs/common"\nimport { MongooseModule } from "@nestjs/mongoose"\nimport { AppController } from "./app.controller"\nimport { AppService } from "./app.service"\nimport { UsersModule } from "./users/users.module"\n\n@Module({\n imports: [\n MongooseModule.forRoot(\n "mongodb+srv://<username>:<password>@cluster0.kngtf.mongodb.net/session-auth?retryWrites=true&w=majority"\n ),\n UsersModule,\n ],\n controllers: [AppController],\n providers: [AppService],\n})\nexport class AppModule {}getUser function to your UsersService with the findOne method to find a user by username.users.service.ts
\nimport { Injectable } from '@nestjs/common';\nimport { InjectModel } from '@nestjs/mongoose';\nimport { Model } from 'mongoose';\nimport { User } from './users.model';\n@Injectable()\nexport class UsersService {\n constructor(@InjectModel('user') private readonly userModel: Model<User>) {}\n async insertUser(userName: string, password: string) {\n const username = userName.toLowerCase();\n const newUser = new this.userModel({\n username,\n password,\n });\n await newUser.save();\n return newUser;\n }\n async getUser(userName: string) {\n const username = userName.toLowerCase();\n const user = await this.userModel.findOne({ username });\n return user;\n }\n}Create Authentication Module
\n
\nnest g module auth\nnest g service authauth.module.ts, and auth.service.ts, and update the auth.module.ts and app.module.ts files.src folder should look as follows.
\n└───src\n│ └───auth\n│ │ └───auth.module.ts\n│ │ └───auth.service.ts\n│ └───users\n│ │ └───users.controller.ts\n│ │ └───users.model.ts\n│ │ └───users.module.ts\n│ │ └───users.service.ts\n│ └───app.controller.ts\n│ └───app.module.ts\n│ └───app.service.ts\n│ └───main.tsapp.module.ts, and it will look like the code snippet below:app.module.ts
\nimport { Module } from "@nestjs/common"\nimport { MongooseModule } from "@nestjs/mongoose"\nimport { AppController } from "./app.controller"\nimport { AppService } from "./app.service"\nimport { UsersModule } from "./users/users.module"\nimport { AuthModule } from './auth/auth.module';\n\n\n@Module({\n imports: [UsersModule, AuthModule, MongooseModule.forRoot(\n //database url string\n 'mongodb://localhost:27017/myapp'\n )],\n controllers: [AppController],\n providers: [AppService],\n})\nexport class AppModule {}Authenticate Users
\nauth.module.ts file and add UsersModule in the imports array to enable access to the UsersService exported from the users.module.ts file.auth.module.ts
\nimport { Module } from "@nestjs/common"\nimport { UsersModule } from "src/users/users.module"\nimport { AuthService } from "./auth.service"\n\n@Module({\n imports: [UsersModule],\n providers: [AuthService],\n})\nexport class AuthModule {}auth.service.ts file, call the constructor so you can inject the UsersService, and add a method for validation that will take a username and password.request.user object — else, return null.auth.service.ts
\n import { Injectable, NotAcceptableException } from '@nestjs/common';\n import { UsersService } from 'src/users/users.service';\n import * as bcrypt from 'bcrypt';\n\n @Injectable()\n export class AuthService {\n constructor(private readonly usersService: UsersService) {}\n async validateUser(username: string, password: string): Promise<any> {\n const user = await this.usersService.getUser(username);\n const passwordValid = await bcrypt.compare(password, user.password)\n if (!user) {\n throw new NotAcceptableException('could not find the user');\n }\n if (user && passwordValid) {\n return {\n userId: user.id,\n userName: user.username\n };\n }\n return null;\n }\n }local.strategy.ts. This file will represent the strategy from Passport.js, which you installed earlier, that is the local strategy. And within it, pass in the strategy, which is the Strategy from passport-local.AuthService, call the super() method; ensure to call the super() method.local.strategy.ts
\n import { Injectable, UnauthorizedException } from '@nestjs/common';\n import { PassportStrategy } from '@nestjs/passport';\n import { Strategy } from 'passport-local';\n import { AuthService } from './auth.service';\n @Injectable()\n export class LocalStrategy extends PassportStrategy(Strategy) {\n constructor(private readonly authService: AuthService) {\n super();\n }\n async validate(username: string, password: string): Promise<any> {\n const userName = username.toLowerCase();\n const user = await this.authService.validateUser(userName, password);\n if (!user) {\n throw new UnauthorizedException();\n }\n return user;\n }\n }auth.module.ts file. Then add PassportModule to imports and LocalStrategy to providers.auth.module.ts
\nimport { Module } from "@nestjs/common"\nimport { PassportModule } from "@nestjs/passport"\nimport { UsersModule } from "src/users/users.module"\nimport { AuthService } from "./auth.service"\nimport { LocalStrategy } from "./local.strategy"\n\n@Module({\n imports: [UsersModule, PassportModule],\n providers: [AuthService, LocalStrategy],\n})\nexport class AuthModule {}users.controller.ts:users.controller.ts
\n import {\n Body,\n Controller,\n Post,\n Request,\n } from '@nestjs/common';\n import * as bcrypt from 'bcrypt';\n import { UsersService } from './users.service';\n @Controller('users')\n export class UsersController {\n constructor(private readonly usersService: UsersService) {}\n //post / signup\n @Post('/signup')\n async addUser(\n @Body('password') userPassword: string,\n @Body('username') userName: string,\n ) {\n const saltOrRounds = 10;\n const hashedPassword = await bcrypt.hash(userPassword, saltOrRounds);\n const result = await this.usersService.insertUser(\n userName,\n hashedPassword,\n );\n return {\n msg: 'User successfully registered',\n userId: result.id,\n userName: result.username\n };\n }\n //Post / Login\n @Post('/login')\n login(@Request() req): any {\n return {User: req.user,\n msg: 'User logged in'};\n }\n }local.auth.guard.ts, then a class LocalAuthGuard that extends AuthGuard from NestJS/passport, where you will provide the name of the strategy and pass in the name of your strategy, local.local.auth.guard.ts.
\nimport { Injectable } from "@nestjs/common"\nimport { AuthGuard } from "@nestjs/passport"\n@Injectable()\nexport class LocalAuthGuard extends AuthGuard("local") {}UseGuard decorator to your login route in the users.controller.ts file, and pass in the LocalAuthGuard.users.controller.ts
\n import {\n Body,\n Controller,\n Post,\n UseGuards,\n Request,\n } from '@nestjs/common';\n import * as bcrypt from 'bcrypt';\n import { LocalAuthGuard } from 'src/auth/local.auth.guard';\n import { UsersService } from './users.service';\n @Controller('users')\n export class UsersController {\n constructor(private readonly usersService: UsersService) {}\n //post / signup\n @Post('/signup')\n async addUser(\n @Body('password') userPassword: string,\n @Body('username') userName: string,\n ) {\n const saltOrRounds = 10;\n const hashedPassword = await bcrypt.hash(userPassword, saltOrRounds);\n const result = await this.usersService.insertUser(\n userName,\n hashedPassword,\n );\n return {\n msg: 'User successfully registered',\n userId: result.id,\n userName: result.username\n };\n }\n //Post / Login\n @UseGuards(LocalAuthGuard)\n @Post('/login')\n login(@Request() req): any {\n return {User: req.user,\n msg: 'User logged in'};\n }\n }Protect Authentication Routes
\nusers.controller.ts file, and add another route — name it ‘protected’ and make it return the req.user object.users.controller.ts
\n import {\n Body,\n Controller,\n Get,\n Post,\n UseGuards,\n Request,\n } from '@nestjs/common';\n import * as bcrypt from 'bcrypt';\n import { LocalAuthGuard } from 'src/auth/local.auth.guard';\n import { UsersService } from './users.service';\n @Controller('users')\n export class UsersController {\n constructor(private readonly usersService: UsersService) {}\n //signup\n @Post('/signup')\n async addUser(\n @Body('password') userPassword: string,\n @Body('username') userName: string,\n ) {\n const saltOrRounds = 10;\n const hashedPassword = await bcrypt.hash(userPassword, saltOrRounds);\n const result = await this.usersService.insertUser(\n userName,\n hashedPassword,\n );\n return {\n msg: 'User successfully registered',\n userId: result.id,\n userName: result.username\n };\n }\n //Post / Login\n @UseGuards(LocalAuthGuard)\n @Post('/login')\n login(@Request() req): any {\n return {User: req.user,\n msg: 'User logged in'};\n }\n // Get / protected\n @Get('/protected')\n getHello(@Request() req): string {\n return req.user;\n }\n }
\nnpm install express-session @types/express-sessionmain.ts file, the root of your application, and do the configurations there.passport and express-session, then add passport initialize and passport session.main.ts
\nimport { NestFactory } from "@nestjs/core"\nimport { AppModule } from "./app.module"\nimport * as session from "express-session"\nimport * as passport from "passport"\nasync function bootstrap() {\n const app = await NestFactory.create(AppModule)\n app.use(\n session({\n secret: "keyboard",\n resave: false,\n saveUninitialized: false,\n })\n )\n app.use(passport.initialize())\n app.use(passport.session())\n\n await app.listen(3000)\n}\nbootstrap()authenticated.guard.ts, in your auth folder. And create a new Guard that checks if there is a session for the user making the request — name it authenticatedGuard.authenticated.guard.ts
\nimport { CanActivate, ExecutionContext, Injectable } from "@nestjs/common"\n\n@Injectable()\nexport class AuthenticatedGuard implements CanActivate {\n async canActivate(context: ExecutionContext) {\n const request = context.switchToHttp().getRequest()\n return request.isAuthenticated()\n }\n}isAuthenticated() comes from passport.js automatically; it says. \"hey! does a session exist for this user? If so, keep going.\"users.controller.ts file:\n
\nauthenticated from authenticated.guard.ts;useGuard decorator to the protected route; and,AuthenticatedGuard.users.controller.ts
\n import {\n Body,\n Controller,\n Get,\n Post,\n UseGuards,\n Request,\n } from '@nestjs/common';\n import * as bcrypt from 'bcrypt';\n import { AuthenticatedGuard } from 'src/auth/authenticated.guard';\n import { LocalAuthGuard } from 'src/auth/local.auth.guard';\n import { UsersService } from './users.service';\n @Controller('users')\n export class UsersController {\n constructor(private readonly usersService: UsersService) {}\n //signup\n @Post('/signup')\n async addUser(\n @Body('password') userPassword: string,\n @Body('username') userName: string,\n ) {\n const saltOrRounds = 10;\n const hashedPassword = await bcrypt.hash(userPassword, saltOrRounds);\n const result = await this.usersService.insertUser(\n userName,\n hashedPassword,\n );\n return {\n msg: 'User successfully registered',\n userId: result.id,\n userName: result.username\n };\n }\n //Post / Login\n @UseGuards(LocalAuthGuard)\n @Post('/login')\n login(@Request() req): any {\n return {User: req.user,\n msg: 'User logged in'};\n }\n //Get / protected\n @UseGuards(AuthenticatedGuard)\n @Get('/protected')\n getHello(@Request() req): string {\n return req.user;\n }\n }express-session but didn't implement it.express-session library stores the session in the web server's memory.session.serializer.ts.src folder should look like this.
\n └───src\n │ └───auth\n │ │ └───auth.module.ts\n │ │ └───auth.service.ts\n │ │ └───authenticated.guard.ts\n │ │ └───local.auth.guard.ts\n │ │ └───local.strategy.ts\n │ │ └───session.serializer.ts\n │ └───users\n │ │ └───users.controller.ts\n │ │ └───users.model.ts\n │ │ └───users.module.ts\n │ │ └───users.service.ts\n │ └───app.controller.ts\n │ └───app.module.ts\n │ └───app.service.ts\n │ └───main.tssession.serializer.ts
\nimport { Injectable } from "@nestjs/common"\nimport { PassportSerializer } from "@nestjs/passport"\n\n@Injectable()\nexport class SessionSerializer extends PassportSerializer {\n serializeUser(user: any, done: (err: Error, user: any) => void): any {\n done(null, user)\n }\n deserializeUser(\n payload: any,\n done: (err: Error, payload: string) => void\n ): any {\n done(null, payload)\n }\n}auth.module.ts file, provide the SessionSerializer, and add the register method to the PassportModule.auth.module.ts
\nimport { Module } from "@nestjs/common"\nimport { PassportModule } from "@nestjs/passport"\nimport { UsersModule } from "src/users/users.module"\nimport { AuthService } from "./auth.service"\nimport { LocalStrategy } from "./local.strategy"\nimport { SessionSerializer } from "./session.serializer"\n\n@Module({\n imports: [UsersModule, PassportModule.register({ session: true })],\n providers: [AuthService, LocalStrategy, SessionSerializer],\n})\nexport class AuthModule {}LocalAuthGuard in the local.auth.guard.ts file.login method in super and pass in the request to trigger the actual login by creating a session. If you want to use sessions, you must remember to trigger the super.login().local.auth.guard.ts
\n import { ExecutionContext, Injectable } from '@nestjs/common';\n import { AuthGuard } from '@nestjs/passport';\n @Injectable()\n export class LocalAuthGuard extends AuthGuard('local') {\n async canActivate(context: ExecutionContext) {\n const result = (await super.canActivate(context)) as boolean;\n const request = context.switchToHttp().getRequest();\n await super.logIn(request);\n return result;\n }\n }Logout Users
\nusers.controller.ts file, add a logout route, and call the req.session.session() method. You can return a message notifying that the user’s session has ended.
\n import {\n Body,\n Controller,\n Get,\n Post,\n UseGuards,\n Request,\n } from '@nestjs/common';\n import * as bcrypt from 'bcrypt';\n import { AuthenticatedGuard } from 'src/auth/authenticated.guard';\n import { LocalAuthGuard } from 'src/auth/local.auth.guard';\n import { UsersService } from './users.service';\n @Controller('users')\n export class UsersController {\n constructor(private readonly usersService: UsersService) {}\n //signup\n @Post('/signup')\n async addUser(\n @Body('password') userPassword: string,\n @Body('username') userName: string,\n ) {\n const saltOrRounds = 10;\n const hashedPassword = await bcrypt.hash(userPassword, saltOrRounds);\n const result = await this.usersService.insertUser(\n userName,\n hashedPassword,\n );\n return {\n msg: 'User successfully registered',\n userId: result.id,\n userName: result.username\n };\n }\n //Post / Login\n @UseGuards(LocalAuthGuard)\n @Post('/login')\n login(@Request() req): any {\n return {User: req.user,\n msg: 'User logged in'};\n }\n //Get / protected\n @UseGuards(AuthenticatedGuard)\n @Get('/protected')\n getHello(@Request() req): string {\n return req.user;\n }\n //Get / logout\n @Get('/logout')\n logout(@Request() req): any {\n req.session.destroy();\n return { msg: 'The user session has ended' }\n }\n }Test Your Application
\n
\nnpm run start:devSign Up As a User
\nLog In As a User
\nLogged-in User’s Cookie ID
\nUser Logout
\nAlternatively, Implement User Authentication with LoginRadius
\nConclusion
\n\n
\n","frontmatter":{"date":"April 26, 2022","updated_date":null,"title":"NestJS: How to Implement Session-Based User Authentication","tags":["Authentication","NestJS","MongoDB","Node.js"],"coverImage":{"childImageSharp":{"fluid":{"aspectRatio":1.5037593984962405,"src":"/static/d28db627e3ed8b9cfc8febf39b1cefad/ee604/session-based-authentication-in-nestjs.png","srcSet":"/static/d28db627e3ed8b9cfc8febf39b1cefad/69585/session-based-authentication-in-nestjs.png 200w,\n/static/d28db627e3ed8b9cfc8febf39b1cefad/497c6/session-based-authentication-in-nestjs.png 400w,\n/static/d28db627e3ed8b9cfc8febf39b1cefad/ee604/session-based-authentication-in-nestjs.png 800w,\n/static/d28db627e3ed8b9cfc8febf39b1cefad/f3583/session-based-authentication-in-nestjs.png 1200w","sizes":"(max-width: 800px) 100vw, 800px"}}},"author":{"id":"Ekekenta Odionyenfe Clinton","github":"icode247","avatar":null}}}},{"node":{"fields":{"slug":"/engineering/guest-post/nestjs-authentication-with-loginradius-api/"},"html":"Authentication vs. Authorization
\nUser Authentication with LoginRadius
\nUser Authentication in NestJS
\nSet Up the Project
\n
\n// Install NestJS CLI\nnpm i -g @nestjs/cli\n\n// Create a new project\nnest new nest-loginradius-auth\n\ncd nest-loginradius-authSet Up LoginRadius
\nSet Up .env file
\n.env file.
\nnpm install dotenv
\nAPP_NAME=<your app name>\nAPI_KEY=<your api key>\nAPI_SECRET=<your api secret>\nSOTT= <your sott>Authentication Flow
\n\n
\nCreate an Authentication Module
\n
\nnest generate module auth\nnest generate controller authCreate a User
\nauth folder, add the dto folder and create a UserDTO class in the user.dto.ts file.
\nexport class UserDto {\n email: string;\n password: string;\n}AuthController, import the DTO to be used to validate the request body.
\nimport { Injectable } from '@nestjs/common';\nimport { UserDto } from './dto/user.dto';\n\n@Injectable()\n@Controller('auth')\nexport class AuthController {\n @Post('signup')\n async signup(@Body() registerUserDto: UserDto) {\n // Register user\n }\n}Generate Auth Service File
\n
\nnest g service auth
\nimport { Injectable } from '@nestjs/common';\nimport { UserDto } from './dto/user.dto';\nimport * as LRAuthPrrovider from 'loginradius-sdk'\n\n@Injectable()\nexport class AuthService {\n async signup(registerUserDto: UserDto) {\n console.log('sign up')\n }\n}auth.controller.ts file.
\nimport { Injectable } from '@nestjs/common';\nimport { UserDto } from './dto/user.dto';\nimport { AuthService } from './auth.service';\n\n@Injectable()\n@Controller('auth')\nexport class AuthController {\n constructor(private readonly authService: AuthService) { }\n\n @Post('signup')\n async signup(@Body() registerUserDto: UserDto) {\n let response = await this.authService.signup(registerUserDto)\n return response\n }\n}loginradius-sdk using the following command.
\nnpm i loginradius-sdkloginradius-sdk and configure it and since you will be using variables from the .env file, remember to also configure dotenv.
\nimport * as dotenv from 'dotenv';\ndotenv.config()\nimport * as LRAuthPrrovider from 'loginradius-sdk'\n\nlet config = {\n apiDomain: "api.loginradius.com",\n apiKey: process.env.API_KEY,\n apiSecret: process.env.API_SECRET,\n siteName: process.env.APP_NAME,\n apiRequestSigning: false,\n proxy: {\n host: "",\n port: "",\n user: "",\n password: "",\n },\n };\nlet lrv2 = LRAuthPrrovider(config);\n\nlet sott = process.env.SOTT
\n@Injectable()\nexport class AuthService {\n async signup(registerUserDto: UserDto) {\n try {\n const response = await lrv2.authenticationApi\n .checkEmailAvailability(registerUserDto.email)\n if (response.isExist) {\n return "Email already in use"\n }\n catch(error) {\n return error\n }\n }\n}
\n@Injectable()\nexport class AuthService {\n async signup(registerUserDto: UserDto) {\n try {\n // check if email is already in use\n const response = await lrv2.authenticationApi\n .checkEmailAvailability(registerUserDto.email)\n if (response.isExist) {\n return "Email already in use"\n }\n // create registration model\n let authUserRegistrationModel = {\n email: [\n {\n type: "primary",\n value: registerUserDto.email,\n },\n ],\n password: registerUserDto.password,\n };\n // register user\n let user = await lrv2.authenticationApi\n .userRegistrationByEmail(authUserRegistrationModel, sott)\n if(user) {\n return "Sign up successful"\n }\n } catch (error) {\n return error\n }\n }\n}authUserRegistrationModel object defines how the email and password will be stored in the database.Log In the User
\nauth.service.ts, add the login function.
\n@Injectable()\nexport class AuthService {\n async signup(registerUserDto: UserDto) {\n // register user\n }\n async login(loginUserDTO: UserDto) {\n // login user\n }\n}
\n@Injectable()\nexport class AuthService {\n async signup(registerUserDto: UserDto) {\n // register user\n }\n async login(loginUserDTO: UserDto) {\n try {\n let emailAuthenticationModel = {\n email: loginUserDTO.email,\n password: loginUserDTO.password,\n };\n let user = await lrv2.authenticationApi\n .loginByEmail(emailAuthenticationModel)\n return {\n accessToken: user.access_token,\n }\n } catch (error) {\n return error\n }\n }\n}accessToken in the response body. The user will use the access token to access protected routes.auth.controller.ts file to use it in the login route.
\nimport { Injectable } from '@nestjs/common';\nimport { UserDto } from './dto/user.dto';\nimport { AuthService } from './auth.service';\n\n@Injectable()\n@Controller('auth')\nexport class AuthController {\n constructor(private readonly authService: AuthService) { }\n\n @Post('signup')\n async signup(@Body() registerUserDto: UserDto) {\n // register user\n }\n async login(@Body() loginUserDto: UserDto) {\n // login user\n }\n}Access Protected Routes
\naccessToken. In this tutorial, you will be storing the token in the authorization header as a bearer token. Another alternative would be to use HTTP-only cookies.auth.guard.ts, add the following code.
\nimport {AuthService } from './auth.service';\nimport { Request } from 'express';\n\n@Injectable()\nexport class AuthGuard implements CanActivate {\n\n constructor(\n private readonly authService: AuthService,\n ) {}\n\n async canActivate(context: ExecutionContext): Promise<boolean> {\n const request: Request = context.switchToHttp().getRequest();\n\n // Extract the access token from the authorization header\n const authheader = request.header('Authorization');\n const token = authheader && authheader.split(" ")[1];\n try {\n let authorizedMsg = await this.authService.authenticate(token);\n // Attach the authorized message to the request. You could also attach the user information.\n request['isAuthorized'] = "Authorized"\n return true;\n } catch (error) {\n throw new UnauthorizedException();\n }\n }\n}authenticate method defined in AuthService. This method will be responsible for verifying the token.auth.service.ts, create the authenticate method. This method will send the access token to LoginRadius for verification.
\nimport { Injectable, UnauthorizedException } from '@nestjs/common';\nimport { UserDto } from './dto/user.dto';\nimport * as LRAuthPrrovider from 'loginradius-sdk'\n\n@Injectable()\nexport class AuthService {\n async signup(registerUserDto: UserDto) {\n // signup user\n }\n async login(loginUserDTO: UserDto) {\n // login user\n }\n async authenticate(accessToken: string) {\n try {\n const response = await lrv2.authenticationApi\n .authValidateAccessToken(accessToken)\n return response\n } catch (error) {\n throw new UnauthorizedException();\n }\n }\n}auth.controller.ts, add the following.
\nimport { Controller, Get, Body, Post, UseGuards } from '@nestjs/common';\nimport { UserDto } from './dto/user.dto';\nimport { AuthService } from './auth.service';\nimport { AuthGuard } from './auth.guard';\n\n@Controller('auth')\nexport class AuthController {\n constructor(private readonly authService: AuthService) { }\n\n @Post('signup')\n async signup(@Body() registerUserDto: UserDto) {\n // signup user\n }\n @Post('login')\n async login(@Body() loginUserDto: UserDto) {\n // login user\n }\n @UseGuards(AuthGuard)\n @Get('protected')\n async protected() {\n return "Access granted"\n }\n}UseGuards to will require a valid access token.Test with Postman
\n
\nPOST http://localhost:3000/auth/signupConclusion
\n