NestJS NestJS Authentication & Security 2 — Questions and Answers
Question 1: What is Role-Based Access Control (RBAC) in the context of NestJS guards?
- A built-in NestJS feature that auto-assigns roles from JWT claims
- A pattern where guards check user roles stored in metadata to allow or deny access (Correct answer)
- A database middleware that filters rows by user role
- An OAuth2 scope validation mechanism
Correct answer: A pattern where guards check user roles stored in metadata to allow or deny access
RBAC in NestJS is implemented by attaching role metadata via custom decorators and checking it inside a guard using Reflector.
Question 2: What does the `@SetMetadata()` decorator do in NestJS?
- Sets HTTP response headers
- Attaches custom key-value metadata to a route handler or controller (Correct answer)
- Defines TypeORM entity metadata
- Configures Swagger documentation metadata
Correct answer: Attaches custom key-value metadata to a route handler or controller
@SetMetadata() stores arbitrary metadata on a route or controller that can later be retrieved by guards or interceptors using Reflector.
Question 3: Which class do NestJS guards need to implement?
- GuardInterface
- CanActivate (Correct answer)
- HttpGuard
- RequestFilter
Correct answer: CanActivate
Guards must implement the CanActivate interface, which requires a canActivate() method that returns a boolean or Observable<boolean>.
Question 4: In NestJS, what is the Reflector class used for inside a guard?
- Reflecting HTTP request headers back to the client
- Retrieving metadata attached to route handlers via decorators (Correct answer)
- Logging reflection data for debugging
- Creating TypeScript type reflections at runtime
Correct answer: Retrieving metadata attached to route handlers via decorators
Reflector.get() or getAllAndOverride() reads the custom metadata set by @SetMetadata() or custom decorators on route handlers.
Question 5: What is the execution order of NestJS request lifecycle components?
- Interceptors → Guards → Pipes → Controllers
- Middleware → Guards → Interceptors → Pipes → Controllers (Correct answer)
- Guards → Middleware → Interceptors → Pipes → Controllers
- Middleware → Interceptors → Guards → Pipes → Controllers
Correct answer: Middleware → Guards → Interceptors → Pipes → Controllers
The NestJS request pipeline executes in this order: Middleware → Guards → Interceptors (before) → Pipes → Controller → Interceptors (after) → Exception Filters.
Question 6: How can you implement refresh token rotation in NestJS?
- Configure JwtModule with `rotate: true` option
- Store refresh tokens in the database, validate on use, then issue a new pair and invalidate the old token (Correct answer)
- Set a short JWT expiry and rely on automatic re-authentication
- Use @nestjs/passport's built-in token rotation feature
Correct answer: Store refresh tokens in the database, validate on use, then issue a new pair and invalidate the old token
Refresh token rotation requires persisting tokens in a DB, verifying the incoming token, issuing a new access+refresh pair, and invalidating the used refresh token to prevent reuse.
NestJS NestJS Authentication & Security 2
What is Role-Based Access Control (RBAC) in the context of NestJS guards?