How to Build a Secure API with NestJS and JWT Authentication

In today's digital landscape, the need for secure applications has never been more critical. Building a secure API is essential for protecting sensitive data and ensuring that only authenticated users can access specific resources. In this article, we will explore how to build a secure API using NestJS and JWT (JSON Web Tokens) authentication. We will dive into definitions, use cases, actionable insights, and provide clear code examples to help you grasp these concepts effectively.

What is NestJS?

NestJS is a progressive Node.js framework that is designed for building efficient and scalable server-side applications. It leverages TypeScript, making it a fantastic choice for developers who prefer type safety and modern JavaScript features. NestJS is built on top of Express, but it also supports other libraries like Fastify, providing developers the flexibility to choose their preferred tools.

Why Choose NestJS for API Development?

• Modular Architecture: NestJS uses a modular architecture, allowing you to organize your code better and make it more maintainable.
• Built-in Support for Middleware: You can easily add middleware to handle requests and responses, making it simple to implement authentication and logging.
• Extensive Ecosystem: With a rich ecosystem of libraries and modules, you can extend your application with features like caching, validation, and database support seamlessly.

Understanding JWT Authentication

JWT (JSON Web Token) is a compact, URL-safe means of representing claims to be transferred between two parties. The claims in a JWT are encoded as a JSON object that is used as the payload of a JSON Web Signature (JWS) structure or as the plaintext of a JSON Web Encryption (JWE) structure, enabling you to verify the sender's identity and ensure the message wasn't altered along the way.

Use Cases for JWT

• Single Page Applications (SPAs): JWT is commonly used for authentication in SPAs where the client needs to verify the identity of users without making repeated calls to the server.
• Mobile Applications: Mobile apps can use JWT to authenticate users by storing the token securely on the device.
• Microservices: In a microservices architecture, JWT can be used to issue a token that can be validated by different services, allowing for a more cohesive security model.

Step-by-Step Guide to Building a Secure API with NestJS and JWT

Step 1: Setting Up Your NestJS Project

First, ensure you have Node.js installed. Then, install the NestJS CLI globally:

npm install -g @nestjs/cli

Create a new NestJS project:

nest new secure-api
cd secure-api

Step 2: Install Required Dependencies

Next, install the necessary packages for JWT authentication:

npm install @nestjs/jwt @nestjs/passport passport passport-jwt bcrypt

Step 3: Create Auth Module

Generate a new module and service for authentication:

nest generate module auth
nest generate service auth

Step 4: Implement JWT Strategy

Create a new file jwt.strategy.ts inside the auth directory. This file will define how the JWT will be validated:

import { Injectable } from '@nestjs/common';
import { JwtStrategy } from '@nestjs/jwt';
import { PassportStrategy } from '@nestjs/passport';
import { ExtractJwt } from 'passport-jwt';
import { AuthService } from './auth.service';

@Injectable()
export class JwtAuthStrategy extends PassportStrategy(JwtStrategy) {
  constructor(private authService: AuthService) {
    super({
      jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
      secretOrKey: 'your_secret_key', // change this to a more secure secret
    });
  }

  async validate(payload: any) {
    return this.authService.validateUser(payload.sub);
  }
}

Step 5: Create Auth Service

In auth.service.ts, implement the logic for validating the user and generating JWT tokens:

import { Injectable } from '@nestjs/common';
import { JwtService } from '@nestjs/jwt';
import * as bcrypt from 'bcrypt';

@Injectable()
export class AuthService {
  constructor(private jwtService: JwtService) {}

  async validateUser(userId: number): Promise<any> {
    // Replace with your user validation logic
    return { userId };
  }

  async login(user: any) {
    const payload = { username: user.username, sub: user.userId };
    return {
      access_token: this.jwtService.sign(payload),
    };
  }

  async hashPassword(password: string): Promise<string> {
    return await bcrypt.hash(password, 10);
  }
}

Step 6: Create Auth Controller

Next, create a controller to handle incoming requests for login:

import { Controller, Post, Body } from '@nestjs/common';
import { AuthService } from './auth.service';

@Controller('auth')
export class AuthController {
  constructor(private authService: AuthService) {}

  @Post('login')
  async login(@Body() user: any) {
    return this.authService.login(user);
  }
}

Step 7: Protecting Routes

To protect your routes, use the @UseGuards() decorator along with AuthGuard from @nestjs/passport. For example:

import { Controller, Get, UseGuards } from '@nestjs/common';
import { AuthGuard } from '@nestjs/passport';

@Controller('protected')
export class ProtectedController {
  @Get()
  @UseGuards(AuthGuard('jwt'))
  getProtectedResource() {
    return { message: 'This is a protected resource' };
  }
}

Step 8: Testing Your API

Run your NestJS application:

npm run start

You can now test your API using Postman or any other API testing tool. First, make a POST request to /auth/login with valid user credentials. You will receive a JWT token. Use this token as a Bearer token in the Authorization header when making requests to the protected routes.

Conclusion

Building a secure API with NestJS and JWT authentication is straightforward and efficient. By following the steps outlined in this article, you can implement a robust authentication system that will protect your application from unauthorized access. Embrace the power of NestJS and JWT to create scalable, maintainable, and secure applications that meet the demands of modern web development. Happy coding!