@nathapp/nestjs-auth

JWT authentication + CASL authorization library for NestJS.

Installation

npm install @nathapp/nestjs-auth @nestjs/passport

Note for Fastify users: There is slightly different request/response handling for Fastify. Interceptors and middleware check req.raw for Fastify vs Express compatibility.

JWKS (Remote Identity Provider)

To verify tokens issued by an external IdP (Auth0, Cognito, Okta, Keycloak), install the optional jwks-rsa peer dependency:

npm install jwks-rsa

Then configure your module:

import { Module } from '@nestjs/common';
import { AuthenticationModule, createJwksStrategyProvider } from '@nathapp/nestjs-auth';
import { MyAuthProvider } from './my-auth-provider';

@Module({
  imports: [
    AuthenticationModule.forRoot({
      jwtOptions: {
        signOption: { algorithm: 'RS256' },
        issuer: 'https://my-tenant.auth0.com/',
        audience: 'https://api.example.com',
        jwks: {
          jwksUri: 'https://my-tenant.auth0.com/.well-known/jwks.json',
          // optional tuning:
          // cacheMaxAge: 600000,
          // jwksRequestsPerMinute: 10,
          // algorithms: ['RS256'],
        },
      },
      authProvider: MyAuthProvider,
    }),
  ],
  // Override the default JwtStrategyProvider with the JWKS factory.
  // Must be registered AFTER AuthenticationModule so DI resolves this provider.
  providers: [createJwksStrategyProvider()],
})
export class AppModule {}

Note: Don't pass strategyProvider: JwksJwtStrategyProvider directly — this monorepo uses useFactory registration (see CLAUDE.md). The createJwksStrategyProvider() helper wires JWT_OPTIONS + AUTH_PROVIDER injection for you.

JWKS Security Defaults

• issuer is required when using JWKS (prevents accepting tokens from any key the URI serves).
• algorithms defaults to ['RS256']. HMAC algorithms (HS*) and none are rejected.
• jwksUri must use HTTPS (set allowInsecure: true only for local dev against a mock server).
• sign() throws in JWKS mode — the strategy is verify-only.