Thank you for the tutotial, it's a good one. I just wanted to make a few points. From the security standpoint, the good practice is to have JWT in memory or basically sending through http context and save refresh token in an http only cookie so when a user leaves their browser and comes back again, the application can uses the refresh token to issue a new access token. But, by using your approach, when a user refreshes their browser or closes it they lose both access and refresh tokens and they have to sign in again in order to access the protected area of the application. In SPA applications you use a refresh token in order to issue an access token again after its expiration, so we need to keep it somewhere safe to use it again, otherwise it is pointless to use it. On top of that, when you only use one refresh token in your user's entity and every time you replace it with a new one, then users will not be able to have their multiple devices logged in, because whenever they logs in in each device,then the previous refresh token they used in another device will be replaced with a new one and their another device will be no longer logged in. So we need a user entity that has one to many relationship with a refresh token entity. You can also read more about the security recommendations for access and refresh tokens from the link below if you are interested: dev.to/cotter/localstorage-vs-cookies-all-you-need-to-know-about-storing-jwt-tokens-securely-in-the-front-end-15id
That's a very clear explanation. Thank you so much. Although I just have one naive question... From SPAs, we always send access tokens in headers... How do we know when to send the refresh token to generate new tokens? I mean when the access token is expired it will send an unauthorised (forbidden) exception or something of that sort. Then how do we send the refresh token? Any working example code would be really helpful. Thank you
@@aadispare3673 Late answer here, but actually when you hit a protected route, if the access token has expired you will get an unauthorized exception, so you must catch this exception by hitting the refresh tokens route if the refresh token is not expired too, then try to hit the first route again
Hey. Nice video. Some points of interest. 1. @Injectable tells Nest to reflect on the constructor and see if there are dependencies it needs to inject into it. If there are no dependencies to inject, you don't need the decorator. 2. You can store tokens in local storage on the client, however they are open to an XSS attack and with 7 days (for the refresh token), a lot of damage can be done. I'd suggest storing the refresh token in an http only cookie. This avoids XSS attacks, as attackers won't be able to get access to the cookie. You should also add the "/refresh" path to the cookie too, so the cookie is only sent on requests made to the "/refresh" endpoint.
Thank you a lot for this comment! 1. Yes 100% :) 2. Excellent suggestion, I had a couple of discussions on reddit and we agreed that what you suggest would be the best solution. I will prepare a video on the subject
@@CodeWithVlad I have a question; while I understand the concept and have some practical experience, one thing I'm having difficulty with is determining the best method to implement this with some frontend code.
To learn NestJS Authentication I have seen many videos and I got confuse about JWT but with your video I am pretty clear and the way you explain everything is awesome. Thanks.
Not long and not tedious. That's what tutroial should be. You get the whole idea in one video and then just keep on your coding. Thank you for the tutorial
This tutorial is excellent. A great teacher, who makes us go deeper into the content through knowledge, good humor, sincerity (because there were no cuts in the moments of code error) and many tips to evolve as developers. Thanks!
Not sure if the 15mins delay logout w/ refresh token hash is from who's idea. that's cunningly brilliant. one of the finest JWT tutorials ever. keep up the good work. i totally appreciate your time and effort.
Vlad, thank you again. You are really putting a lot of effort into these videos dude and we can see it in your how you are able to tie multiple concepts together in a way that logically flows so well! You have taught us in hours what it takes some years to understand so thank you for literally giving me extra life points! 👏👏👏
I was trying to find a tutorial for many days that would explain the reason for each thing and not just give me the code. Your tutorial is one of the best I've seen on UA-cam and I'm surprised it's free, congratulations on something so amazing, you earned a subscriber. I hope you can launch courses, I will buy for sure. Hugs from Brazil!
Прекрасное видео! Видно, что в проекте позже был использован Аргон, что тоже круто) Надеюсь увидеть в будущем более продвинутую реализацию, в том числе с функционалом активации аккаунта по почтовому ящику. Спасибо за такой ценный контент!
This is excellent content 💯. The flow of learning concepts and writing code hits the mark. Major kudos for covering typescript safety, especially for creating custom decorators and explaining the public guards. Thank you, this was an easy subscription from me.
Nice tutorial, thanks! Actually it's nice seeing someone experienced mess up a little bit and find the solution on the go, that's how coding really is like.
That was awesome! I'm new with NestJs and started to create my own demos. I've learned almost everything from you. Thank you so much for sharing that much information.
Спасибо, Влад! Супер комплексный подход! В самом начале долго не мог понять, так какой же стандарт жизни access токена, 15 или 50 минут. Я же дилетант, обычно делал пять часов. ) Просто обычно в слове "fifteen" ударение на последний слог, а слышалось как будто "fifty" с ударением на первый слог. Еще раз спасибо за видео!
This is elegant, Vlad. You inductively demystify the abstract concepts and made them look simpler for digestion. I look forward to learning the Microservice with NestJs from you. Thanks, Man! 🥰
i'm following this tutorial using Mongo instead of Postgres and it's even simpler. i don't know if it's more appropriate but it's easier. just a few issues related to migrate and the id field but other than that, very smooth sailing
This is such an amazing video. Glad I stumbled across this. Subscribed. Would be going through the other videos on your channel. And, eager to learn more from you. Thank you so much.
I'm so glad that you are using the same tech stacks as me. Nest.js + Prisma is so powerful. Can you make a video about deployment? I'm so curious about what cloud provider you use and how you handle the deployment.
You're the best! All the things that I know in NestJS are thank to you and your videos, you explain it so well! Now I was wondering, can you make a video on Redis and sessions too?
Why is everyone storing refresh token as a column in users table? That make no sense, because users can be logged in only on one device with refresh token. In my opinion better is to store both tokens as http only cookies with refresh token saved only with "/refresh" path and stored in Redis with key like "refresh:userId:jti". You can then store some device informations in the payload to let the end user list all refresh tokens with their devices and ability to instantly revoke
Hey Vlad, great video! However, I noticed a downside to this approach, if a user signs in in another app/device his first refresh token will stop working, since the hashed refresh token in the DB will be updated at the moment of the second sign in. Lets say you have a web app and a mobile app. A user signs in in the web app and then proceeds to sign in in the mobile app. The moment the user signs in the mobile app his refresh token for the web app will be replaced in the DB with the mobile app's refresh token, later at the moment of requesting new tokens from the web app this will fail and he will have to log in again, which will then cause the same issue but in the mobile app. In other words, a user won't be able to maintain 2 "sessions" in different devices/apps.
Hi and thank you for the explanations which really help to understand JWT and refresh. But we really lose the interesting side of stateless because the logic is designed to handle only one login at a time. If you sign from another device, you lose the previous hash... I think it's better to keep a history per user in redis, a hashmap per user containing all the hashes of refresh tokens and a TTL close to that JWT expirations. This allows you to logout by removing the correct hashes in redis and even to log out all devices by removing the complete hashmap.
Nice video, Vlad! Btw, did you try to use autogenerated prisma DTOs? Do you know how we can validate, cover in documentation (and all that stuff) them by any chance?
That's an awesome tutorial! This was awesome. But I have a question: So with this method, it is not possible to have multiple refresh token hash by user. What would be the way of doing it ? Aren't we recreating OAuth2.0?
But in this scenario, when an access token expires and we call the refresh endpoint, we're updating both tokens. Given this situation, the refresh token expiration wouldn't make sense, right?
Thank you for the tutotial, it's a good one. I just wanted to make a few points. From the security standpoint, the good practice is to have JWT in memory or basically sending through http context and save refresh token in an http only cookie so when a user leaves their browser and comes back again, the application can uses the refresh token to issue a new access token. But, by using your approach, when a user refreshes their browser or closes it they lose both access and refresh tokens and they have to sign in again in order to access the protected area of the application. In SPA applications you use a refresh token in order to issue an access token again after its expiration, so we need to keep it somewhere safe to use it again, otherwise it is pointless to use it. On top of that, when you only use one refresh token in your user's entity and every time you replace it with a new one, then users will not be able to have their multiple devices logged in, because whenever they logs in in each device,then the previous refresh token they used in another device will be replaced with a new one and their another device will be no longer logged in. So we need a user entity that has one to many relationship with a refresh token entity. You can also read more about the security recommendations for access and refresh tokens from the link below if you are interested:
dev.to/cotter/localstorage-vs-cookies-all-you-need-to-know-about-storing-jwt-tokens-securely-in-the-front-end-15id
That's a very clear explanation. Thank you so much. Although I just have one naive question... From SPAs, we always send access tokens in headers... How do we know when to send the refresh token to generate new tokens?
I mean when the access token is expired it will send an unauthorised (forbidden) exception or something of that sort. Then how do we send the refresh token?
Any working example code would be really helpful. Thank you
@@aadispare3673
checkout this tutorial by Dave Gray ua-cam.com/video/4TtAGhr61VI/v-deo.html
@@aadispare3673 Late answer here, but actually when you hit a protected route, if the access token has expired you will get an unauthorized exception, so you must catch this exception by hitting the refresh tokens route if the refresh token is not expired too, then try to hit the first route again
@@qunther makes sense mate. Thank you 😊
Cool!
Hey. Nice video. Some points of interest.
1. @Injectable tells Nest to reflect on the constructor and see if there are dependencies it needs to inject into it. If there are no dependencies to inject, you don't need the decorator.
2. You can store tokens in local storage on the client, however they are open to an XSS attack and with 7 days (for the refresh token), a lot of damage can be done. I'd suggest storing the refresh token in an http only cookie. This avoids XSS attacks, as attackers won't be able to get access to the cookie. You should also add the "/refresh" path to the cookie too, so the cookie is only sent on requests made to the "/refresh" endpoint.
Thank you a lot for this comment! 1. Yes 100% :) 2. Excellent suggestion, I had a couple of discussions on reddit and we agreed that what you suggest would be the best solution. I will prepare a video on the subject
Can the mobile client access the cookie if the refresh token is stored in cookie with httponly?
@@ahmadnabil5779 No. That's the reason why there are httponly cookies, so clients can't mess with them.
I like that you don't cut out the way you look for bugs in the code. It helps to keep track of the way you think when something goes wrong
This is the greatest guide to understanding JWT + refresh! Thank you so much, it really helped me really nail down this concept and practice!
Thanks a lot! It makes my day :)
Please don't forget to use argon2 instead of bcrypt (check the pinned comment)
@@CodeWithVlad I have a question; while I understand the concept and have some practical experience, one thing I'm having difficulty with is determining the best method to implement this with some frontend code.
To learn NestJS Authentication I have seen many videos and I got confuse about JWT but with your video I am pretty clear and the way you explain everything is awesome.
Thanks.
You came here and wondering is it worth watching this video? Absolutely!
Thanks, Vlad!
Not long and not tedious. That's what tutroial should be. You get the whole idea in one video and then just keep on your coding. Thank you for the tutorial
Great tutorials you make. Congrats mate! Please covers specs and integration testing.
All planned :)
The video on integration testing will be released 9am today :)
Thank you so much I finally searched all over the Internet
Tnak you! :D
Thank you very much for showing the context and how it is actually done in a real project :)
This tutorial is excellent.
A great teacher, who makes us go deeper into the content through knowledge, good humor, sincerity (because there were no cuts in the moments of code error) and many tips to evolve as developers.
Thanks!
You are awesome. You are making me to love nestjs more. Thank you sensei 😊
me recognizing the errors before vlad does proves i m getting better😂 thanks for the explanation tho i needed this
What a masterclass on the subject! Thank you really much for publishing this video!
one of the best videos in authentication using refresh tokens
This is amazing tutorial 🙌,
I remember before watching the video I had implement Auth-JWT and it took 3 days to understand and implement.
Massive thanks for this wonderful video. You saved me days! Vlad, I wish you to thrive in your career :)
Vlad is the best tutor for me
Not sure if the 15mins delay logout w/ refresh token hash is from who's idea. that's cunningly brilliant. one of the finest JWT tutorials ever. keep up the good work. i totally appreciate your time and effort.
Can't believe I made it all the way to the end!! Thanks so much.
Vlad, thank you again. You are really putting a lot of effort into these videos dude and we can see it in your how you are able to tie multiple concepts together in a way that logically flows so well! You have taught us in hours what it takes some years to understand so thank you for literally giving me extra life points! 👏👏👏
Thank you a lot Christopher!
I was trying to find a tutorial for many days that would explain the reason for each thing and not just give me the code. Your tutorial is one of the best I've seen on UA-cam and I'm surprised it's free, congratulations on something so amazing, you earned a subscriber. I hope you can launch courses, I will buy for sure. Hugs from Brazil!
wow - well done Vlad, one of the most comprehensive tutorials / real course, thanks a bunch for your effort and for sharing this knowledge!
Прекрасное видео! Видно, что в проекте позже был использован Аргон, что тоже круто) Надеюсь увидеть в будущем более продвинутую реализацию, в том числе с функционалом активации аккаунта по почтовому ящику. Спасибо за такой ценный контент!
Thanks for this wonderful tutorial! It was great understanding refresh tokens along with Nestjs at the same time
Great tutorials! Explained clearly with a very practical project! Thanks a lot for your sharing!
Looking forward to your new videos about anything :D
Wish I found your video few days back. Great explanation, one of the best I heard & actually understood. Many thanks Vlad.
Man... This is actually one of the best tutorial I've ever watched ! You're a really good teacher, thanks a lot !
you are a GOD i watched so many tutorials and yours is the only one that actually works, 🙏🏻🙏🏻🙏🏻🙏🏻🙏🏻🙏🏻🙏🏻🙏🏻🙏🏻🙏🏻
Thank you!
Awesome. i followed this exciting tutorial to build authentication for my own project. Thank you
Thanks this is the type of quality tutorials I want to see on UA-cam!
More to come!
This has been by far the best tutorial I have seen about authentication in nest with jwt, congratulations!
Thank you! 😊
This is excellent content 💯. The flow of learning concepts and writing code hits the mark. Major kudos for covering typescript safety, especially for creating custom decorators and explaining the public guards. Thank you, this was an easy subscription from me.
I'm glad you loved it! Please don't forget to use argon2 instead of bcrypt (check the pinned comment)
Nice tutorial, thanks! Actually it's nice seeing someone experienced mess up a little bit and find the solution on the go, that's how coding really is like.
I think this is the best tutorial for auth flow. Thanks!
That was awesome! I'm new with NestJs and started to create my own demos. I've learned almost everything from you. Thank you so much for sharing that much information.
Glad to help!
this is awesome , this is best tutorial i have seen for jwt authentication on youtube
Best video I've seen so far for the JWT implementation in Nest Js. Thanks Vlad.
Subscribed :)
Спасибо, Влад! Супер комплексный подход! В самом начале долго не мог понять, так какой же стандарт жизни access токена, 15 или 50 минут. Я же дилетант, обычно делал пять часов. ) Просто обычно в слове "fifteen" ударение на последний слог, а слышалось как будто "fifty" с ударением на первый слог. Еще раз спасибо за видео!
Забавно, я тоже об этом думал, но не стал писать, думал непринципиально, но оказывается кого-то это даже путает)
This is elegant, Vlad. You inductively demystify the abstract concepts and made them look simpler for digestion. I look forward to learning the Microservice with NestJs from you.
Thanks, Man! 🥰
Aaah microservices, I will get to them soon. Need to first provide content on sessions and graphql. :) Thank you Akeren, much appreciated!
i'm following this tutorial using Mongo instead of Postgres and it's even simpler. i don't know if it's more appropriate but it's easier. just a few issues related to migrate and the id field but other than that, very smooth sailing
I just want to say this is a blessing, thank you, excellent
Just helped me do the first task in my internship!
Thxxxx
Glad to hear that Ali!
Vlad, loved your video on NextJS on Free code camp. Thank you. Really appreciate it.
this is pure gold! Thank you so much
Thank you
Best learning content and teacher i ever seen!
It was good Christmas with this tutorial , thanks
Thank you, it was an incredible tutorial
This tutorial is more then excellent.
Amazing Man! I just followed and implemented AT & RT. Yuhuuu....Thanks...!
This tutorial is excellent.
Thank you very much
Vlad aka darslariz juda zo'r (from Uzbekistan)
Excelente, es la mejor explicación que he encontrado. Te lo agradezo mucho
Thank you for Excellent tutorial. Yes of course I like to understand testing techniques too.
Thanks
I'm glad you loved it! Please don't forget to use argon2 instead of bcrypt (check the pinned comment)
Thank you, very nice tutorial, i'll try to implement this with redis too.
Sorry for my english and thank you again.
WOW, very interesting, please, keep going with videos like this!
Thanks, will do!
was looking for something like this!
Amazing!
This is such an amazing video. Glad I stumbled across this. Subscribed. Would be going through the other videos on your channel. And, eager to learn more from you.
Thank you so much.
Thank you so much bro. This is very helpful for me and everyone
Vlad keep going! Amazing stuff
thanks for tutorial, you explained very well and easily help me a lot.
Excellent tutorial, Its very helpful. Thank you very much Boss
I'm so glad that you are using the same tech stacks as me. Nest.js + Prisma is so powerful. Can you make a video about deployment? I'm so curious about what cloud provider you use and how you handle the deployment.
Hey! Thank you for your comment and suggestion. This topic is definitely planned! For deployment I am using aws and hetzner cloud
@@CodeWithVlad im waiting :D
You're amazing dude, I really appreciate it. You helped me out so much!
Amazing tutorial, so glad I found this
You can replace 60 * 60 * 24 * 7 in expiresIn with string '7d'/'15m'/'1w' etc...
Very nice video. But get very complicated after some time. :P Thank you Vlad
You're the best! All the things that I know in NestJS are thank to you and your videos, you explain it so well! Now I was wondering, can you make a video on Redis and sessions too?
Super detailed video, thanks. It would be cool if you showed how to add Google authorization to this
Кекаю с каждого "МЫТАДАТА" (metadata) произнесенного на протяжение видео)) Но да, за гайд респект, очень подробно всё и это прекрасно)
haha :)
Why is everyone storing refresh token as a column in users table? That make no sense, because users can be logged in only on one device with refresh token. In my opinion better is to store both tokens as http only cookies with refresh token saved only with "/refresh" path and stored in Redis with key like "refresh:userId:jti". You can then store some device informations in the payload to let the end user list all refresh tokens with their devices and ability to instantly revoke
But anyway it is the best video covering this topic I've ever seen
Cookies are to avoid like hell on any manner in any modern app design
Bro make a pull request. This would help
Thanks a lot. Very nice 🔥🔥
Hey Vlad, great video! However, I noticed a downside to this approach, if a user signs in in another app/device his first refresh token will stop working, since the hashed refresh token in the DB will be updated at the moment of the second sign in. Lets say you have a web app and a mobile app. A user signs in in the web app and then proceeds to sign in in the mobile app. The moment the user signs in the mobile app his refresh token for the web app will be replaced in the DB with the mobile app's refresh token, later at the moment of requesting new tokens from the web app this will fail and he will have to log in again, which will then cause the same issue but in the mobile app. In other words, a user won't be able to maintain 2 "sessions" in different devices/apps.
Yeah, so you need to store tokens separated from users table
Thank you so much! Very useful video
I was looking for this, thanks! 🙌
Was here for the refresh function part... Ends up watching the whole video ! Thank you for all the tips !
Can you explain why are you using index.ts ?
Super detailed and useful examples !❤
Thank you! 😃
Thank you. I have learned a lot.
Wow, that's great.
Muchas gracias hermano, bendiciones. He aprendído mucho y quiero que sepas que me estouy dedicando al back-end.
Vlad, thanks for the great and awesome content.
Now, which theme are u using ? haha
Great tutorial 🔥👏 please do one with sessions as well
A lot of people asking for sessions, seem like I don't have the choice than to make a video about that :)
Thanks, great tutorial!
Great video Vlad 👌🏻👌🏻👌🏻👌🏻👌🏻
Hi and thank you for the explanations which really help to understand JWT and refresh. But we really lose the interesting side of stateless because the logic is designed to handle only one login at a time. If you sign from another device, you lose the previous hash... I think it's better to keep a history per user in redis, a hashmap per user containing all the hashes of refresh tokens and a TTL close to that JWT expirations. This allows you to logout by removing the correct hashes in redis and even to log out all devices by removing the complete hashmap.
At that point you might as well use sessions.
@@nobytes2 if the client handle it ;)
Excellent thanks very mucsh
Awesome video.
You're awesome. Thank for this tutorial. Btw, what do you use autocomplete in command line ?
Nice video, Vlad!
Btw, did you try to use autogenerated prisma DTOs? Do you know how we can validate, cover in documentation (and all that stuff) them by any chance?
Excellent tutorial !👏👏
You are awesome!, Thank you.
amazing tutorial vlad!
Thanks Tim!
Damn! You nailed it 🙏
you are the best pro, thank you :)
Thank you It is very helpful
That's an awesome tutorial! This was awesome. But I have a question:
So with this method, it is not possible to have multiple refresh token hash by user. What would be the way of doing it ?
Aren't we recreating OAuth2.0?
Excellent video
Awesome tutorial. Thank you so much! Can you please make a tutorial about CICD with NestJs and Prisma.
Thank you for the compliment and the suggestion. It’s an interesting topic. I will see if i can cover it in a future video.
Good job!
But in this scenario, when an access token expires and we call the refresh endpoint, we're updating both tokens. Given this situation, the refresh token expiration wouldn't make sense, right?