Tag
authentication
Published articles tagged authentication.
Authentication and authorization in GraphQL
GraphQL needs identity in context and authorization at field granularity. This chapter covers transport auth, resolver and field guards, NestJS GqlExecutionContext, node(id) IDOR risks, and subscription connection_init.
Authentication in MongoDB
MongoDB separates who you are from what you may do. Authentication verifies identity with SCRAM; authorization assigns roles on databases and collections. This page covers users, built-in roles, connection strings, Docker bootstrap credentials, and Atlas database users from application code.
Authentication in NestJS
NestJS authentication is built from guards: one checks a password and issues a token, another verifies that token on every later request. This chapter wires Passport's local and JWT strategies into a Nest app, then protects every route by default with a global guard and a @Public() opt-out.
JWT, JWS, JWE, and JOSE
JOSE is the specification family for signing and encrypting a set of claims in a URL-safe token. This page separates JWT, JWS, JWE, and JWK, shows how the compact forms are assembled, and lists the checks a recipient makes before trusting those claims.