JWT Strategies & RBAC — Series 2

Preview — 3 of 10 questions

What does this setting do, and why is it dangerous?

javascript

super({
  jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
  ignoreExpiration: true,      // ✗
  secretOrKey: config.get('JWT_SECRET'),
});

AIt skips signature verification, which is the real problem here

BIt silently converts expired tokens into refresh tokens

CIt tells passport-jwt not to check the exp claim — so a token remains valid forever, removing the only automatic limit on how long a leaked token can be used

DIt only affects tokens without an exp claim, so the setting is harmless

What does the async form provide that register() does not?

javascript

JwtModule.registerAsync({
  imports: [ConfigModule],
  inject: [ConfigService],
  useFactory: (config: ConfigService) => ({
    secret: config.getOrThrow<string>('JWT_SECRET'),
    signOptions: { expiresIn: config.get('JWT_TTL', '15m') },
  }),
});

AThe options are produced by a factory that runs through the DI container, so the secret comes from a validated, injectable configuration source rather than being read from process.env at module-evaluation time

BIt makes token signing asynchronous, improving throughput

CIt allows the secret to be changed at runtime without restarting

DIt is required whenever expiresIn is set

Why is the second argument to PassportStrategy necessary?

javascript

@Injectable()
export class RefreshStrategy extends PassportStrategy(Strategy, 'jwt-refresh') {
  constructor(config: ConfigService) {
    super({
      jwtFromRequest: ExtractJwt.fromBodyField('refreshToken'),
      secretOrKey: config.getOrThrow('JWT_REFRESH_SECRET'),
      passReqToCallback: true,
    });
  }
}

AIt sets the name of the request.user property this strategy populates

BIt declares the algorithm used to verify the token

CIt is optional and purely documentary

DIt names the strategy, so two strategies built on the same underlying class can coexist — AuthGuard('jwt') and AuthGuard('jwt-refresh') then select between them

Answer all 10 questions (7 more), see explanations for every answer, and track your score.