Nestjs guards auth
Skill dkmqflx/claude-tools/.claude/skills/nestjs-guards-auth
npx -y skills add dkmqflx/claude-tools --skill nestjs-guards-authAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
2 things to look at
- no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
- 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
NestJS guards, authentication, and authorization best practices. Use when implementing or reviewing auth in NestJS — guards, JWT/Passport strategies, RBAC, route protection. Triggers on CanActivate, AuthGuard, JwtStrategy, @Roles, @Public, or Reflector.
The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.
SKILL.md
3.1 KB, 655 tokens by cl100k_base, as published. Nobody here has run it
NestJS Guards, Auth & Authorization
Best practices for securing NestJS applications with guards, Passport-based JWT authentication, and role-based authorization. Verified against the current NestJS v10/v11 documentation (guards, authentication, authorization, and the Passport recipe).
The core mental model: authentication (authn) answers "who are you?" and
runs as a guard that validates a credential and attaches a typed user to the
request. Authorization (authz) answers "are you allowed?" and runs as a
separate guard that reads route metadata via Reflector and compares it against
that user. Keep these two concerns in distinct guards, declare a strong JWT
config from the environment, and never leak whether a credential was valid.
When to Apply
Reference these rules when:
- Implementing login / token issuance or protecting routes in NestJS
- Writing or reviewing a
CanActivateguard,AuthGuard, orJwtStrategy - Setting up Passport (
@nestjs/passport+passport-jwt) - Adding role-based access control (
@Roles,RolesGuard) - Registering a global auth guard with per-route opt-out (
@Public) - Reviewing how
req.useris typed, how secrets are configured, or how auth failures are surfaced to clients
Rules
| Rule | Impact | Summary |
|---|---|---|
| separate-authn-from-authz | HIGH | Keep identity verification and permission checks in distinct guards |
| passport-jwt-strategy | HIGH | Use @nestjs/passport + a passport-jwt strategy class for JWT auth |
| global-auth-guard-with-public | HIGH | Register a global auth guard and opt out via @Public() metadata |
| roles-guard-rbac | HIGH | Drive RBAC with @Roles() metadata read by a RolesGuard via Reflector |
| hash-passwords | CRITICAL | Never store plaintext; hash with bcrypt/argon2 + salt |
| type-the-request-user | MEDIUM | Strongly type req.user; never trust an unvalidated payload |
| dont-leak-auth-details | HIGH | Return generic 401/403; don't reveal whether a user exists |
| validate-jwt-config | CRITICAL | Load a strong secret from config/env with sane expiry; verify signature and expiration |
How to Use
Read individual rule files for the rationale and incorrect/correct code:
rules/passport-jwt-strategy.md
rules/roles-guard-rbac.md
Each rule file contains a short explanation of why it matters, followed by an Incorrect and a Correct TypeScript example. Apply CRITICAL and HIGH impact rules first when reviewing existing auth code.
Gives 1 of the 12 instructions most auth identity skills give in 655 tokens
Counted across 409 of the 410 authors here whose files we hold, read 2026-08-06
- hash passwords with bcrypt or argon2here, and in 53 of 409, across 43 files
- use parameterized queriesin 47 of 409, across 39 files
- load SECRET_KEY from environment variablesin 23 of 409, across 14 files
- validate all input server-sidein 19 of 409, across 11 files
- refresh access tokens before expiryin 17 of 409, across 9 files
- store tokens in httponly cookiesin 17 of 409, across 16 files
- store refresh tokens securelyin 16 of 409, across 6 files
- validate webhook signatures before processingin 15 of 409, across 5 files
- sanitize user inputsin 15 of 409, across 9 files
- implement rate limiting on auth endpointsin 14 of 409, across 9 files
- encrypt sensitive data at restin 13 of 409, across 10 files
- validate uploaded file extensions and sizesin 12 of 409, across 5 files
Said here and by no other author read
- use passport jwt for json web token auth
- register a global auth guard with public opt out
- strongly type the request user object
- load jwt config from environment
- apply critical and high impact rules first
Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.