**Course Title:** Mastering NestJS: Building Scalable Server-Side Applications **Section Title:** Security Best Practices in NestJS **Topic:** Implement JWT authentication and role-based access control for your RESTful API.(Lab topic) **Overview** In this lab topic, we will implement JWT (JSON Web Token) authentication and role-based access control for our RESTful API using NestJS. We will cover the following key concepts: * Understanding JWT authentication * Implementing JWT authentication in NestJS * Understanding role-based access control * Implementing role-based access control in NestJS **Prerequisites** Before starting this lab, make sure you have completed the following topics: * Introduction to NestJS and Development Environment * Controllers and Routing * Dependency Injection and Service Providers * Working with Databases: TypeORM and Data Transfer Objects (DTOs) * Error Handling and Validation * Security Best Practices in NestJS (previous topics) **Implementing JWT Authentication** JWT authentication is a widely used authentication mechanism that involves exchanging a username and password for a JSON Web Token (JWT). The JWT contains the user's identity and is used to authenticate subsequent requests. To implement JWT authentication in NestJS, we will use the `@nestjs/jwt` package. First, install the package using npm: ```bash npm install @nestjs/jwt ``` Next, create a new file called `auth.module.ts` and add the following code: ```typescript import { src/auth/auth.module.ts } import { Module } from '@nestjs/common'; import { JwtModule } from '@nestjs/jwt'; import { AuthService } from './auth.service'; import { AuthController } from './auth.controller'; @Module({ imports: [ JwtModule.register({ secret: 'your-secret-key', signOptions: { expiresIn: '1h' }, }), ], providers: [AuthService], controllers: [AuthController], }) export class AuthModule {} ``` In the above code, we are registering the `JwtModule` with a secret key and sign options. We are also providing the `AuthService` and `AuthController`. **Implementing Role-Based Access Control** Role-based access control (RBAC) is a security mechanism that restricts access to resources based on a user's role. In NestJS, we can implement RBAC using the `@nestjs/passport` package. First, install the package using npm: ```bash npm install @nestjs/passport ``` Next, create a new file called `rbac.module.ts` and add the following code: ```typescript { src/rbac/rbac.module.ts } import { Module } from '@nestjs/common'; import { PassportModule } from '@nestjs/passport'; import { RolesGuard } from './roles.guard'; import { UsersService } from './users.service'; import { UsersController } from './users.controller'; @Module({ imports: [PassportModule.register({ defaultStrategy: 'jwt' })], providers: [RolesGuard, UsersService], controllers: [UsersController], }) export class RbacModule {} ``` In the above code, we are registering the `PassportModule` with the default strategy set to `jwt`. We are also providing the `RolesGuard`, `UsersService`, and `UsersController`. **Implementing JWT Authentication and Role-Based Access Control** To implement JWT authentication and role-based access control, we need to create a new file called `auth.controller.ts` and add the following code: ```typescript { src/auth/auth.controller.ts } import { Controller, Post, Body, Req, Res } from '@nestjs/common'; import { AuthService } from './auth.service'; import { JwtStrategy } from './jwt.strategy'; @Controller('auth') export class AuthController { constructor(private readonly authService: AuthService, private readonly jwtStrategy: JwtStrategy) {} @Post('login') async login(@Body() loginDto: any, @Req() req: Request, @Res() res: Response) { const user = await this.authService.validateUser(loginDto); if (!user) { return res.status(401).send({ message: 'Invalid credentials' }); } const token = await this.jwtStrategy.generateToken(user); return res.send({ token }); } } ``` In the above code, we are creating a new controller called `AuthController` that has a single method called `login`. This method takes in a `loginDto` object, a `req` object, and a `res` object. It uses the `AuthService` to validate the user and then generates a JWT token using the `JwtStrategy`. **Conclusion** In this lab topic, we implemented JWT authentication and role-based access control for our RESTful API using NestJS. We covered the following key concepts: * Understanding JWT authentication * Implementing JWT authentication in NestJS * Understanding role-based access control * Implementing role-based access control in NestJS We also created a new file called `auth.controller.ts` that has a single method called `login`. This method takes in a `loginDto` object, a `req` object, and a `res` object. It uses the `AuthService` to validate the user and then generates a JWT token using the `JwtStrategy`. **Exercise** Implement JWT authentication and role-based access control for your RESTful API using NestJS. Create a new file called `auth.controller.ts` and add the following code: ```typescript { src/auth/auth.controller.ts } import { Controller, Post, Body, Req, Res } from '@nestjs/common'; import { AuthService } from './auth.service'; import { JwtStrategy } from './jwt.strategy'; @Controller('auth') export class AuthController { constructor(private readonly authService: AuthService, private readonly jwtStrategy: JwtStrategy) {} @Post('login') async login(@Body() loginDto: any, @Req() req: Request, @Res() res: Response) { const user = await this.authService.validateUser(loginDto); if (!user) { return res.status(401).send({ message: 'Invalid credentials' }); } const token = await this.jwtStrategy.generateToken(user); return res.send({ token }); } } ``` **Leave a comment below if you have any questions or need help with implementing JWT authentication and role-based access control for your RESTful API using NestJS.** **Next topic:** Introduction to microservices architecture.