How should authentication and permissions work?
Try code in the playgroundUnderstand the concept
Authentication establishes who the caller is, and permissions determine which actions and records that caller may access. In Nest, guards commonly apply these checks before controller execution, often using Passport strategies for authentication. Resource-level checks still need enough context to enforce ownership and tenant rules.
Important ideas
-
An authentication guard validates credentials and attaches the user.
-
A permission guard checks access to the action or resource.
-
Check ownership and tenant boundaries too; a role alone may not be enough.
-
Never accept a requested role or tenant from the body as proof of the caller's authority.
Can you explain it without the notes?
How should authentication and permissions work?
Use your own words. Explain an example and one limitation before checking the explanation.
Check your explanation
Authentication establishes who the caller is, and permissions determine which actions and records that caller may access. In Nest, guards commonly apply these checks before controller execution, often using Passport strategies for authentication. Resource-level checks still need enough context to enforce ownership and tenant rules.
Turn this concept into a clear answer.
- A valid token proves only the validated claims; it does not automatically authorize every route or database row.
Adapted from 03_NESTJS.md · “How should authentication and permissions work?”. Examples are study fragments; framework behavior can depend on your version.