Passport & JWT Basics — Series 3

Preview — 3 of 10 questions

Where does req.user come from?

javascript

@UseGuards(JwtAuthGuard)
@Get('me')
me(@Request() req) {
  return req.user;
}

AFrom a cookie the browser sends alongside the token

BThe strategy's validate() returned it, and Passport attached the result to the request — so anything downstream in this request, including other guards and the handler, reads the same object

CNest populates it from the Authorization header automatically, with no strategy involved

DFrom the database, queried freshly on each property access

What does raising the number from 10 to 12 do?

javascript

await bcrypt.hash(password, 12);

AIt lengthens the resulting hash proportionally

BIt adds two more random salt bytes

CIt allows two additional login attempts before lockout

DIt quadruples the work per hash — the factor is a base-2 exponent — which makes offline cracking of a stolen hash four times more expensive, at the cost of the same slowdown on every legitimate login

Why express the rules here rather than inside the service?

javascript

export class RegisterDto {
  @IsEmail() email: string;

  @IsString()
  @MinLength(12)
  @Matches(/[^A-Za-z0-9]/, { message: 'password must contain a symbol' })
  password: string;
}

AValidation at the boundary rejects a bad payload before any business logic or hashing runs, and the rules are declared next to the shape they constrain — so the service can assume a valid password and the API returns a precise 400 naming the failed rule

BBecause class-validator decorators only work on DTO classes used in controllers

CBecause hashing would fail on a password shorter than 12 characters

DBecause the service has no access to the raw password

Answer all 10 questions (7 more), see explanations for every answer, and track your score.