Thank you for the tutotial, it's a good one. I just wanted to make a few points. From the security standpoint, the good practice is to have JWT in memory or basically sending through http context and save refresh token in an http only cookie so when a user leaves their browser and comes back again, the application can uses the refresh token to issue a new access token. But, by using your approach, when a user refreshes their browser or closes it they lose both access and refresh tokens and they have to sign in again in order to access the protected area of the application. In SPA applications you use a refresh token in order to issue an access token again after its expiration, so we need to keep it somewhere safe to use it again, otherwise it is pointless to use it. On top of that, when you only use one refresh token in your user's entity and every time you replace it with a new one, then users will not be able to have their multiple devices logged in, because whenever they logs in in each device,then the previous refresh token they used in another device will be replaced with a new one and their another device will be no longer logged in. So we need a user entity that has one to many relationship with a refresh token entity. You can also read more about the security recommendations for access and refresh tokens from the link below if you are interested: dev.to/cotter/localstorage-vs-cookies-all-you-need-to-know-about-storing-jwt-tokens-securely-in-the-front-end-15id
That's a very clear explanation. Thank you so much. Although I just have one naive question... From SPAs, we always send access tokens in headers... How do we know when to send the refresh token to generate new tokens? I mean when the access token is expired it will send an unauthorised (forbidden) exception or something of that sort. Then how do we send the refresh token? Any working example code would be really helpful. Thank you
@@aadispare3673 Late answer here, but actually when you hit a protected route, if the access token has expired you will get an unauthorized exception, so you must catch this exception by hitting the refresh tokens route if the refresh token is not expired too, then try to hit the first route again
Hey. Nice video. Some points of interest. 1. @Injectable tells Nest to reflect on the constructor and see if there are dependencies it needs to inject into it. If there are no dependencies to inject, you don't need the decorator. 2. You can store tokens in local storage on the client, however they are open to an XSS attack and with 7 days (for the refresh token), a lot of damage can be done. I'd suggest storing the refresh token in an http only cookie. This avoids XSS attacks, as attackers won't be able to get access to the cookie. You should also add the "/refresh" path to the cookie too, so the cookie is only sent on requests made to the "/refresh" endpoint.
Thank you a lot for this comment! 1. Yes 100% :) 2. Excellent suggestion, I had a couple of discussions on reddit and we agreed that what you suggest would be the best solution. I will prepare a video on the subject
@@CodeWithVlad I have a question; while I understand the concept and have some practical experience, one thing I'm having difficulty with is determining the best method to implement this with some frontend code.
To learn NestJS Authentication I have seen many videos and I got confuse about JWT but with your video I am pretty clear and the way you explain everything is awesome. Thanks.
This tutorial is excellent. A great teacher, who makes us go deeper into the content through knowledge, good humor, sincerity (because there were no cuts in the moments of code error) and many tips to evolve as developers. Thanks!
Not long and not tedious. That's what tutroial should be. You get the whole idea in one video and then just keep on your coding. Thank you for the tutorial
Vlad, thank you again. You are really putting a lot of effort into these videos dude and we can see it in your how you are able to tie multiple concepts together in a way that logically flows so well! You have taught us in hours what it takes some years to understand so thank you for literally giving me extra life points! 👏👏👏
i'm following this tutorial using Mongo instead of Postgres and it's even simpler. i don't know if it's more appropriate but it's easier. just a few issues related to migrate and the id field but other than that, very smooth sailing
Nice tutorial, thanks! Actually it's nice seeing someone experienced mess up a little bit and find the solution on the go, that's how coding really is like.
Not sure if the 15mins delay logout w/ refresh token hash is from who's idea. that's cunningly brilliant. one of the finest JWT tutorials ever. keep up the good work. i totally appreciate your time and effort.
I was trying to find a tutorial for many days that would explain the reason for each thing and not just give me the code. Your tutorial is one of the best I've seen on RUclips and I'm surprised it's free, congratulations on something so amazing, you earned a subscriber. I hope you can launch courses, I will buy for sure. Hugs from Brazil!
Прекрасное видео! Видно, что в проекте позже был использован Аргон, что тоже круто) Надеюсь увидеть в будущем более продвинутую реализацию, в том числе с функционалом активации аккаунта по почтовому ящику. Спасибо за такой ценный контент!
This is excellent content 💯. The flow of learning concepts and writing code hits the mark. Major kudos for covering typescript safety, especially for creating custom decorators and explaining the public guards. Thank you, this was an easy subscription from me.
That was awesome! I'm new with NestJs and started to create my own demos. I've learned almost everything from you. Thank you so much for sharing that much information.
This is elegant, Vlad. You inductively demystify the abstract concepts and made them look simpler for digestion. I look forward to learning the Microservice with NestJs from you. Thanks, Man! 🥰
Спасибо, Влад! Супер комплексный подход! В самом начале долго не мог понять, так какой же стандарт жизни access токена, 15 или 50 минут. Я же дилетант, обычно делал пять часов. ) Просто обычно в слове "fifteen" ударение на последний слог, а слышалось как будто "fifty" с ударением на первый слог. Еще раз спасибо за видео!
But in this scenario, when an access token expires and we call the refresh endpoint, we're updating both tokens. Given this situation, the refresh token expiration wouldn't make sense, right?
Hey Vlad, great video! However, I noticed a downside to this approach, if a user signs in in another app/device his first refresh token will stop working, since the hashed refresh token in the DB will be updated at the moment of the second sign in. Lets say you have a web app and a mobile app. A user signs in in the web app and then proceeds to sign in in the mobile app. The moment the user signs in the mobile app his refresh token for the web app will be replaced in the DB with the mobile app's refresh token, later at the moment of requesting new tokens from the web app this will fail and he will have to log in again, which will then cause the same issue but in the mobile app. In other words, a user won't be able to maintain 2 "sessions" in different devices/apps.
This is such an amazing video. Glad I stumbled across this. Subscribed. Would be going through the other videos on your channel. And, eager to learn more from you. Thank you so much.
I'm so glad that you are using the same tech stacks as me. Nest.js + Prisma is so powerful. Can you make a video about deployment? I'm so curious about what cloud provider you use and how you handle the deployment.
Why is everyone storing refresh token as a column in users table? That make no sense, because users can be logged in only on one device with refresh token. In my opinion better is to store both tokens as http only cookies with refresh token saved only with "/refresh" path and stored in Redis with key like "refresh:userId:jti". You can then store some device informations in the payload to let the end user list all refresh tokens with their devices and ability to instantly revoke
You're the best! All the things that I know in NestJS are thank to you and your videos, you explain it so well! Now I was wondering, can you make a video on Redis and sessions too?
Hi and thank you for the explanations which really help to understand JWT and refresh. But we really lose the interesting side of stateless because the logic is designed to handle only one login at a time. If you sign from another device, you lose the previous hash... I think it's better to keep a history per user in redis, a hashmap per user containing all the hashes of refresh tokens and a TTL close to that JWT expirations. This allows you to logout by removing the correct hashes in redis and even to log out all devices by removing the complete hashmap.
Hi guys, I followed the guide completely, but I used argon instead of bcrypt and I have the following problem: when I take a refresh token and refresh it, then I can refresh it again with the old refresh token. Thus, if an attacker takes possession of the refresh token, then he can always receive an access token, this is bad. Does the bcrypt solution have the same problem?
Merry Christmas everyone! After some tests, I realized that bcrypt is not a good option for that case since it can only compare passwords that are smaller than 72 bytes! The JWT we hash is bigger than 72 bytes, hence the compare function will always return true! 😐 Please use argon2 instead of bcrypt! www.npmjs.com/package/argon2 Also, I have a more recent video on authentication where I don't recommend using JWT as a session token and use session instead: ruclips.net/video/8haNjnq26K4/видео.html
If I understand your comment correctly it sounded like you say that the user password is stored in the JWT. This is a big NO! as JWT token can be parsed by anyone and therefore get the password that you stored in it
@@rluvaton No it does not store the user password. I was talking about the fact that the library "bcrypt" is used for storing passwords (which are usually less that 72 bytes long). So the verify function does not work correctly with longer values.
Hi vlad, how you handle or invalidated access token after logout? I have try overwrite the access token and refresh token to be expiring after a few second but it seems like does not have effect on it.
Nice video, Vlad! Btw, did you try to use autogenerated prisma DTOs? Do you know how we can validate, cover in documentation (and all that stuff) them by any chance?
![NestJS Authorization. Авторизация. JwtStrategy. JwtGuard. PostgreSQL, ReactJS [eng subs].](http://i.ytimg.com/vi/n7PjVqKspuA/mqdefault.jpg)
![NestJS Authorization. Авторизация. JwtStrategy. JwtGuard. PostgreSQL, ReactJS [eng subs].](/img/tr.png)
Thank you for the tutotial, it's a good one. I just wanted to make a few points. From the security standpoint, the good practice is to have JWT in memory or basically sending through http context and save refresh token in an http only cookie so when a user leaves their browser and comes back again, the application can uses the refresh token to issue a new access token. But, by using your approach, when a user refreshes their browser or closes it they lose both access and refresh tokens and they have to sign in again in order to access the protected area of the application. In SPA applications you use a refresh token in order to issue an access token again after its expiration, so we need to keep it somewhere safe to use it again, otherwise it is pointless to use it. On top of that, when you only use one refresh token in your user's entity and every time you replace it with a new one, then users will not be able to have their multiple devices logged in, because whenever they logs in in each device,then the previous refresh token they used in another device will be replaced with a new one and their another device will be no longer logged in. So we need a user entity that has one to many relationship with a refresh token entity. You can also read more about the security recommendations for access and refresh tokens from the link below if you are interested:
dev.to/cotter/localstorage-vs-cookies-all-you-need-to-know-about-storing-jwt-tokens-securely-in-the-front-end-15id
That's a very clear explanation. Thank you so much. Although I just have one naive question... From SPAs, we always send access tokens in headers... How do we know when to send the refresh token to generate new tokens?
I mean when the access token is expired it will send an unauthorised (forbidden) exception or something of that sort. Then how do we send the refresh token?
Any working example code would be really helpful. Thank you
@@aadispare3673
checkout this tutorial by Dave Gray ruclips.net/video/4TtAGhr61VI/видео.html
@@aadispare3673 Late answer here, but actually when you hit a protected route, if the access token has expired you will get an unauthorized exception, so you must catch this exception by hitting the refresh tokens route if the refresh token is not expired too, then try to hit the first route again
@@qunther makes sense mate. Thank you 😊
Cool!
Hey. Nice video. Some points of interest.
1. @Injectable tells Nest to reflect on the constructor and see if there are dependencies it needs to inject into it. If there are no dependencies to inject, you don't need the decorator.
2. You can store tokens in local storage on the client, however they are open to an XSS attack and with 7 days (for the refresh token), a lot of damage can be done. I'd suggest storing the refresh token in an http only cookie. This avoids XSS attacks, as attackers won't be able to get access to the cookie. You should also add the "/refresh" path to the cookie too, so the cookie is only sent on requests made to the "/refresh" endpoint.
Thank you a lot for this comment! 1. Yes 100% :) 2. Excellent suggestion, I had a couple of discussions on reddit and we agreed that what you suggest would be the best solution. I will prepare a video on the subject
Can the mobile client access the cookie if the refresh token is stored in cookie with httponly?
@@ahmadnabil5779 No. That's the reason why there are httponly cookies, so clients can't mess with them.
I like that you don't cut out the way you look for bugs in the code. It helps to keep track of the way you think when something goes wrong
This is the greatest guide to understanding JWT + refresh! Thank you so much, it really helped me really nail down this concept and practice!
Thanks a lot! It makes my day :)
Please don't forget to use argon2 instead of bcrypt (check the pinned comment)
@@CodeWithVlad I have a question; while I understand the concept and have some practical experience, one thing I'm having difficulty with is determining the best method to implement this with some frontend code.
To learn NestJS Authentication I have seen many videos and I got confuse about JWT but with your video I am pretty clear and the way you explain everything is awesome.
Thanks.
You came here and wondering is it worth watching this video? Absolutely!
Thanks, Vlad!
This tutorial is excellent.
A great teacher, who makes us go deeper into the content through knowledge, good humor, sincerity (because there were no cuts in the moments of code error) and many tips to evolve as developers.
Thanks!
Not long and not tedious. That's what tutroial should be. You get the whole idea in one video and then just keep on your coding. Thank you for the tutorial
Thank you so much I finally searched all over the Internet
Tnak you! :D
me recognizing the errors before vlad does proves i m getting better😂 thanks for the explanation tho i needed this
Massive thanks for this wonderful video. You saved me days! Vlad, I wish you to thrive in your career :)
Vlad is the best tutor for me
What a masterclass on the subject! Thank you really much for publishing this video!
Great tutorials you make. Congrats mate! Please covers specs and integration testing.
All planned :)
The video on integration testing will be released 9am today :)
Thank you very much for showing the context and how it is actually done in a real project :)
one of the best videos in authentication using refresh tokens
Vlad, thank you again. You are really putting a lot of effort into these videos dude and we can see it in your how you are able to tie multiple concepts together in a way that logically flows so well! You have taught us in hours what it takes some years to understand so thank you for literally giving me extra life points! 👏👏👏
Thank you a lot Christopher!
You are awesome. You are making me to love nestjs more. Thank you sensei 😊
This is amazing tutorial 🙌,
I remember before watching the video I had implement Auth-JWT and it took 3 days to understand and implement.
Can't believe I made it all the way to the end!! Thanks so much.
Vlad aka darslariz juda zo'r (from Uzbekistan)
Thanks for this wonderful tutorial! It was great understanding refresh tokens along with Nestjs at the same time
You can replace 60 * 60 * 24 * 7 in expiresIn with string '7d'/'15m'/'1w' etc...
i'm following this tutorial using Mongo instead of Postgres and it's even simpler. i don't know if it's more appropriate but it's easier. just a few issues related to migrate and the id field but other than that, very smooth sailing
Nice tutorial, thanks! Actually it's nice seeing someone experienced mess up a little bit and find the solution on the go, that's how coding really is like.
Awesome. i followed this exciting tutorial to build authentication for my own project. Thank you
Not sure if the 15mins delay logout w/ refresh token hash is from who's idea. that's cunningly brilliant. one of the finest JWT tutorials ever. keep up the good work. i totally appreciate your time and effort.
wow - well done Vlad, one of the most comprehensive tutorials / real course, thanks a bunch for your effort and for sharing this knowledge!
Wish I found your video few days back. Great explanation, one of the best I heard & actually understood. Many thanks Vlad.
you are a GOD i watched so many tutorials and yours is the only one that actually works, 🙏🏻🙏🏻🙏🏻🙏🏻🙏🏻🙏🏻🙏🏻🙏🏻🙏🏻🙏🏻
Thank you!
I was trying to find a tutorial for many days that would explain the reason for each thing and not just give me the code. Your tutorial is one of the best I've seen on RUclips and I'm surprised it's free, congratulations on something so amazing, you earned a subscriber. I hope you can launch courses, I will buy for sure. Hugs from Brazil!
Great tutorials! Explained clearly with a very practical project! Thanks a lot for your sharing!
Looking forward to your new videos about anything :D
I think this is the best tutorial for auth flow. Thanks!
Man... This is actually one of the best tutorial I've ever watched ! You're a really good teacher, thanks a lot !
Thank you, it was an incredible tutorial
this is awesome , this is best tutorial i have seen for jwt authentication on youtube
Best learning content and teacher i ever seen!
Прекрасное видео! Видно, что в проекте позже был использован Аргон, что тоже круто) Надеюсь увидеть в будущем более продвинутую реализацию, в том числе с функционалом активации аккаунта по почтовому ящику. Спасибо за такой ценный контент!
Just helped me do the first task in my internship!
Thxxxx
Glad to hear that Ali!
This is excellent content 💯. The flow of learning concepts and writing code hits the mark. Major kudos for covering typescript safety, especially for creating custom decorators and explaining the public guards. Thank you, this was an easy subscription from me.
I'm glad you loved it! Please don't forget to use argon2 instead of bcrypt (check the pinned comment)
Thanks this is the type of quality tutorials I want to see on RUclips!
More to come!
Vlad, loved your video on NextJS on Free code camp. Thank you. Really appreciate it.
I just want to say this is a blessing, thank you, excellent
This has been by far the best tutorial I have seen about authentication in nest with jwt, congratulations!
Thank you! 😊
It was good Christmas with this tutorial , thanks
That was awesome! I'm new with NestJs and started to create my own demos. I've learned almost everything from you. Thank you so much for sharing that much information.
Glad to help!
This tutorial is more then excellent.
Best video I've seen so far for the JWT implementation in Nest Js. Thanks Vlad.
Subscribed :)
Amazing Man! I just followed and implemented AT & RT. Yuhuuu....Thanks...!
This is elegant, Vlad. You inductively demystify the abstract concepts and made them look simpler for digestion. I look forward to learning the Microservice with NestJs from you.
Thanks, Man! 🥰
Aaah microservices, I will get to them soon. Need to first provide content on sessions and graphql. :) Thank you Akeren, much appreciated!
this is pure gold! Thank you so much
Thank you
Спасибо, Влад! Супер комплексный подход! В самом начале долго не мог понять, так какой же стандарт жизни access токена, 15 или 50 минут. Я же дилетант, обычно делал пять часов. ) Просто обычно в слове "fifteen" ударение на последний слог, а слышалось как будто "fifty" с ударением на первый слог. Еще раз спасибо за видео!
Забавно, я тоже об этом думал, но не стал писать, думал непринципиально, но оказывается кого-то это даже путает)
Thank you, very nice tutorial, i'll try to implement this with redis too.
Sorry for my english and thank you again.
But in this scenario, when an access token expires and we call the refresh endpoint, we're updating both tokens. Given this situation, the refresh token expiration wouldn't make sense, right?
This tutorial is excellent.
Thank you very much
Excelente, es la mejor explicación que he encontrado. Te lo agradezo mucho
thanks for tutorial, you explained very well and easily help me a lot.
Thank you so much bro. This is very helpful for me and everyone
Thank you for Excellent tutorial. Yes of course I like to understand testing techniques too.
Thanks
I'm glad you loved it! Please don't forget to use argon2 instead of bcrypt (check the pinned comment)
Excellent tutorial, Its very helpful. Thank you very much Boss
was looking for something like this!
Amazing!
Vlad keep going! Amazing stuff
You're amazing dude, I really appreciate it. You helped me out so much!
WOW, very interesting, please, keep going with videos like this!
Thanks, will do!
Super detailed video, thanks. It would be cool if you showed how to add Google authorization to this
Hey Vlad, great video! However, I noticed a downside to this approach, if a user signs in in another app/device his first refresh token will stop working, since the hashed refresh token in the DB will be updated at the moment of the second sign in. Lets say you have a web app and a mobile app. A user signs in in the web app and then proceeds to sign in in the mobile app. The moment the user signs in the mobile app his refresh token for the web app will be replaced in the DB with the mobile app's refresh token, later at the moment of requesting new tokens from the web app this will fail and he will have to log in again, which will then cause the same issue but in the mobile app. In other words, a user won't be able to maintain 2 "sessions" in different devices/apps.
Yeah, so you need to store tokens separated from users table
This is such an amazing video. Glad I stumbled across this. Subscribed. Would be going through the other videos on your channel. And, eager to learn more from you.
Thank you so much.
Very nice video. But get very complicated after some time. :P Thank you Vlad
Amazing tutorial, so glad I found this
Thanks a lot. Very nice 🔥🔥
I'm so glad that you are using the same tech stacks as me. Nest.js + Prisma is so powerful. Can you make a video about deployment? I'm so curious about what cloud provider you use and how you handle the deployment.
Hey! Thank you for your comment and suggestion. This topic is definitely planned! For deployment I am using aws and hetzner cloud
@@CodeWithVlad im waiting :D
Muchas gracias hermano, bendiciones. He aprendído mucho y quiero que sepas que me estouy dedicando al back-end.
Thank you so much! Very useful video
Wow, that's great.
Кекаю с каждого "МЫТАДАТА" (metadata) произнесенного на протяжение видео)) Но да, за гайд респект, очень подробно всё и это прекрасно)
haha :)
Thank you. I have learned a lot.
Why is everyone storing refresh token as a column in users table? That make no sense, because users can be logged in only on one device with refresh token. In my opinion better is to store both tokens as http only cookies with refresh token saved only with "/refresh" path and stored in Redis with key like "refresh:userId:jti". You can then store some device informations in the payload to let the end user list all refresh tokens with their devices and ability to instantly revoke
But anyway it is the best video covering this topic I've ever seen
Cookies are to avoid like hell on any manner in any modern app design
Bro make a pull request. This would help
You're the best! All the things that I know in NestJS are thank to you and your videos, you explain it so well! Now I was wondering, can you make a video on Redis and sessions too?
I was looking for this, thanks! 🙌
Super detailed and useful examples !❤
Thank you! 😃
Thanks, great tutorial!
Hi and thank you for the explanations which really help to understand JWT and refresh. But we really lose the interesting side of stateless because the logic is designed to handle only one login at a time. If you sign from another device, you lose the previous hash... I think it's better to keep a history per user in redis, a hashmap per user containing all the hashes of refresh tokens and a TTL close to that JWT expirations. This allows you to logout by removing the correct hashes in redis and even to log out all devices by removing the complete hashmap.
At that point you might as well use sessions.
@@nobytes2 if the client handle it ;)
Was here for the refresh function part... Ends up watching the whole video ! Thank you for all the tips !
Can you explain why are you using index.ts ?
Awesome video.
Hi guys, I followed the guide completely, but I used argon instead of bcrypt and I have the following problem: when I take a refresh token and refresh it, then I can refresh it again with the old refresh token. Thus, if an attacker takes possession of the refresh token, then he can always receive an access token, this is bad. Does the bcrypt solution have the same problem?
Merry Christmas everyone!
After some tests, I realized that bcrypt is not a good option for that case since it can only compare passwords that are smaller than 72 bytes!
The JWT we hash is bigger than 72 bytes, hence the compare function will always return true! 😐
Please use argon2 instead of bcrypt! www.npmjs.com/package/argon2
Also, I have a more recent video on authentication where I don't recommend using JWT as a session token and use session instead: ruclips.net/video/8haNjnq26K4/видео.html
If I understand your comment correctly it sounded like you say that the user password is stored in the JWT.
This is a big NO! as JWT token can be parsed by anyone and therefore get the password that you stored in it
@@rluvaton No it does not store the user password. I was talking about the fact that the library "bcrypt" is used for storing passwords (which are usually less that 72 bytes long). So the verify function does not work correctly with longer values.
thank you! I was going crazy because the refresh token was always returning true
RefreshToken should be some hash, but not JWT :)
Thank you It is very helpful
Excellent thanks very mucsh
00:00:00 Introduction
00:19:23 Database migration
you are the best pro, thank you :)
Hi vlad, how you handle or invalidated access token after logout? I have try overwrite the access token and refresh token to be expiring after a few second but it seems like does not have effect on it.
Great video Vlad 👌🏻👌🏻👌🏻👌🏻👌🏻
You are awesome!, Thank you.
Vlad, thanks for the great and awesome content.
Now, which theme are u using ? haha
Excellent tutorial !👏👏
Excellent video
Thanks, a lot!!!
Damn! You nailed it 🙏
Nice video, Vlad!
Btw, did you try to use autogenerated prisma DTOs? Do you know how we can validate, cover in documentation (and all that stuff) them by any chance?
Great tutorial 🔥👏 please do one with sessions as well
A lot of people asking for sessions, seem like I don't have the choice than to make a video about that :)