Nestjs security

Skill ComeOnOliver/skillshub/skills/HoangNguyen0403/agent-skills-standard/nestjs-security

🧠 The right skill, one API call. AI agent skills registry with token-efficient skill resolution. 5,000+ skills from 500+ top repos.

Install

npx -y skills add ComeOnOliver/skillshub --skill nestjs-security

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

What its author says it does

Copied from the file, not written here

Authentication, RBAC, and Hardening standards. Use when implementing JWT auth, RBAC guards, or security hardening in NestJS. (triggers: **/*.guard.ts, **/*.strategy.ts, **/auth/**, Passport, JWT, AuthGuard, CSRF, Helmet)

SKILL.md

2.2 KB, as published. Nobody here has run it

NestJS Security Standards

Priority: P0 (CRITICAL)

Authentication (JWT)

Strategy: Use @nestjs/passport with passport-jwt.
Algorithm: Enforce RS256 (preferred) or HS256. Reject none.
Claims: Validate iss and aud.
Tokens: Short access (15m), Long httponly refresh (7d).
MFA: Require 2FA for admin panels.

Authorization (RBAC)

Deny by default: Bind AuthGuard globally (APP_GUARD).
Bypass: Create @Public() decorator for open routes.
Roles: Use Reflector.getAllAndOverride for Method/Class merge.

Cryptography

Hashing: Use Argon2id, not Bcrypt. See implementation.
Encryption: Use AES-256-GCM with KMS rotation. See implementation.

Hardening

Helmet: Mandatory. Enable HSTS, CSP.
CORS: Explicit origins only. No *.
Throttling: Use Redis-backed @nestjs/throttler in production.
CSRF: Required for cookie-based auth. See implementation.

Data Protection

Sanitization: Use ClassSerializerInterceptor + @Exclude().
Validation: ValidationPipe({ whitelist: true }) to prevent mass assignment.
Audit: Log mutations (Who, What, When). See implementation.

Secrets Management

CI/CD: Run npm audit --prod in pipelines.
Runtime: Inject via vault (AWS Secrets Manager / HashiCorp Vault), not .env.

Anti-Patterns

No Shadow APIs: Audit routes regularly; disable /docs in production.
No SSRF: Allowlist domains for all outgoing HTTP requests.
No SQLi: Use ORM; avoid raw query() with string concatenation.
No XSS: Sanitize HTML input with dompurify.