Implementing OAuth 2.0 in a NestJS API for Secured Access

In today's digital landscape, securing your APIs is more critical than ever. One of the most effective ways to achieve this is through OAuth 2.0, an industry-standard protocol for authorization. In this article, we will explore how to implement OAuth 2.0 in a NestJS API, providing you with step-by-step instructions and practical code examples to ensure secured access for your users.

What is OAuth 2.0?

OAuth 2.0 is an authorization framework that allows third-party applications to obtain limited access to user accounts on an HTTP service. It enables applications to access resources without sharing credentials, dramatically enhancing security. Here are some key terms you should know:

• Resource Owner: The user who owns the data.
• Client: The application requesting access to the resource.
• Authorization Server: The server that issues access tokens to the client after successfully authenticating the user.
• Resource Server: The server that hosts the protected resources.

Why Use OAuth 2.0?

Using OAuth 2.0 provides several benefits:

• Enhanced Security: Credentials are never shared directly, reducing the risk of compromise.
• Granular Access Control: You can permit limited access based on user roles or scopes.
• User Experience: Users can authorize access without sharing their passwords.

Use Cases for OAuth 2.0

1. Third-Party Applications: Allow users to log in to your application using their Google or Facebook accounts.
2. Mobile Applications: Securely access user data stored on your server.
3. API Integrations: Enable seamless data exchange between different services.

Setting Up a NestJS API

Before we dive into OAuth 2.0 implementation, make sure you have a basic NestJS project set up. You can create a new NestJS project by running:

npm i -g @nestjs/cli
nest new my-nest-api
cd my-nest-api

Next, install the necessary packages:

npm install @nestjs/passport passport passport-oauth2
npm install @nestjs/jwt jsonwebtoken
npm install --save-dev @types/passport @types/passport-oauth2

Step-by-Step Implementation of OAuth 2.0

Step 1: Create an Auth Module

Create a new module for authentication:

nest generate module auth
nest generate service auth
nest generate controller auth

Step 2: Configure Passport Strategy

In the auth module, define the OAuth 2.0 strategy in auth.service.ts:

import { Injectable } from '@nestjs/common';
import { PassportStrategy } from '@nestjs/passport';
import { Strategy } from 'passport-oauth2';

@Injectable()
export class OAuth2Strategy extends PassportStrategy(Strategy) {
  constructor() {
    super({
      authorizationURL: 'https://provider.com/oauth/authorize',
      tokenURL: 'https://provider.com/oauth/token',
      clientID: 'YOUR_CLIENT_ID',
      clientSecret: 'YOUR_CLIENT_SECRET',
      callbackURL: 'http://localhost:3000/auth/callback',
    });
  }

  async validate(accessToken: string, refreshToken: string, profile: any) {
    // Here you'd typically query your database for user info
    return { accessToken, profile };
  }
}

Step 3: Implementing the Auth Controller

Next, set up the routes in auth.controller.ts:

import { Controller, Get, Req, Res } from '@nestjs/common';
import { AuthService } from './auth.service';

@Controller('auth')
export class AuthController {
  constructor(private readonly authService: AuthService) {}

  @Get('login')
  async login(@Res() res) {
    // Redirect to the OAuth provider's login page
    res.redirect('https://provider.com/oauth/authorize');
  }

  @Get('callback')
  async callback(@Req() req, @Res() res) {
    const user = await this.authService.validateUser(req); // Implement validateUser in auth.service.ts
    // Handle user session or token generation here
    res.json(user);
  }
}

Step 4: Register the Strategy in the Module

Don't forget to register the strategy in your auth.module.ts:

import { Module } from '@nestjs/common';
import { AuthService } from './auth.service';
import { AuthController } from './auth.controller';
import { OAuth2Strategy } from './oauth2.strategy';

@Module({
  controllers: [AuthController],
  providers: [AuthService, OAuth2Strategy],
})
export class AuthModule {}

Step 5: Protecting Your Routes

You can protect your routes by using guards. Create a guard in auth.guard.ts:

import { Injectable, CanActivate, ExecutionContext } from '@nestjs/common';
import { Reflector } from '@nestjs/core';

@Injectable()
export class AuthGuard implements CanActivate {
  constructor(private reflector: Reflector) {}

  canActivate(context: ExecutionContext): boolean {
    const request = context.switchToHttp().getRequest();
    return !!request.user; // Check if user is authenticated
  }
}

Step 6: Using the Guard

Finally, protect your routes by applying the guard:

import { Controller, Get, UseGuards } from '@nestjs/common';
import { AuthGuard } from './auth.guard';

@Controller('protected')
export class ProtectedController {
  @Get()
  @UseGuards(AuthGuard)
  getProtectedResource() {
    return { message: 'This is a protected resource!' };
  }
}

Conclusion

Implementing OAuth 2.0 in your NestJS API not only enhances security but also improves user experience by allowing users to authenticate through familiar platforms. By following this comprehensive guide, you can ensure that your API is secure while providing seamless access to your users.

Final Tips

• Testing: Always test your OAuth implementation thoroughly.
• Environment Variables: Use environment variables to manage sensitive data like client IDs and secrets.
• Monitoring: Implement logging and monitoring to keep track of authentication flows.

With these steps, you are well on your way to implementing a robust OAuth 2.0 solution in your NestJS API. Happy coding!