Authentication and handling user sessions with custom Node API

[vivid elbow]

Hi there,

I am developing my first bigger personal project. Therefore I have set up an API using NestJS, so basically an express API.

I've installed next-auth to my project and want to use the credentials provider. No I am stuck in building as I don't know whats supposed to happened after my frontend calls the API. My payload consist of the username and hashed password and my api checks if those credentials match my database entry. But what should my API return so nextJS can handle the user session?

I was talking about NestJS API not NextJS API

[scarlet pilot]

Oh didn’t notice that, sorry

[vivid elbow]

You are welcome, I totally understand how this two names can be confused 😄

[gray swan]

I am also trying to figure out how to make nextjs + nestjs play well together,
I guess the solution is somewhere here: https://authjs.dev/guides/basics/callbacks

What i've found out to this point is that if you don't store sessions in your DB,
you can access the user token through http cookies on the server side, but if i understand correctly, it's not recommended to decode it in nestjs.

Although if you share the same secret for both servers, you can use
import { getToken } from 'next-auth/jwt';
in a nestjs guard. But again im not sure if this introduces security concerns.

Feel free to DM me if you find anything 🙂

[tardy lichen]

NextAuth isn't framework agnostic, its named Next because its only designed for Next.

Although, I think you can get away with this using JWT tokens.

There was a recent announcement of Auth.js which is basically the agnostic version of this. However, I haven't tested that yet.

[vivid elbow]

Thanks mate for giving a hint in the right direction. I try to figure things out. As far as I know yet, that shouldn't be a big issues, the just aren't any good resources on it. In my case I have a SQL database on the backend I want to integrate. I use prisma for the sake of convience, but it's not necessary. I will send you my working solution when I get it done.

[vivid elbow]

I don't know if understanding you correctly with the framework agnostic thing, but when it comes to NextAuth, using the credentials provider is the way to go I think. NestJS might be a backend framework but in the end it's just an abstraction layer on express. I like to use it because the code is very clean, but in terms of implementation its the same as with any REST Api.

[tardy lichen]

Are you referring to this? https://next-auth.js.org/providers/credentials

Credentials is just a fancy term they used but its still just JWT nonetheless. That's the way if you have an existing authentication service in place or planning to make one.

@vivid elbow I'm just now realizing that, in your Nest app, you can always just query for sessions in your database directly.

[vivid elbow]

Yes that what I mean. I know I have to use JWT. I just don't know how correctly. It's really no big deal to get the data send from Next to my API. I'm stuck as I don't know how to move on from there, to get the session context in next working. So I basically don't know what to return to next from my api after the sign in attempt

To be honest, maybe it's pretty easy and I am just failing to understand 😄

[tardy lichen]

So I basically don't know what to return to next from my api after the sign in attempt
Assuming API here refers to Nest, you don't really need to return anything don't you? The auth part will be handled in your Next app.

Nest isn't concerned with the authentication process at all.

All Nest needs to be able to do is verify the user's session to protect endpoints.

[vivid elbow]

And this is my missing part

[tardy lichen]

That should be as simple as verifying the JWT token.

Which, you really only need the encryption details.

[vivid elbow]

With encryption details you are refering to my JWT secret key?

[tardy lichen]

Yeah, things like that

Issuer, Audience, etc.

Can't recall the rest