User Registration with Hashing

Introduction: The Importance of Secure User Registration

Welcome to the first lesson of the Secure Your API with Authentication and Authorization course. In this lesson, you’ll implement secure user registration in your NestJS API.

Why is this important?

Applications that accept user accounts need to store passwords securely. Storing passwords in plain text is extremely risky. If your database is ever exposed, attackers gain direct access to all accounts. To avoid this, we use password hashing before saving user credentials. By the end of this lesson, you’ll have a working /auth/register endpoint that: Accepts a name, username, and password. Hashes the password securely before storing. Saves the new user in a mock database. Rejects duplicate usernames. You’ll also get a first look at JWTs (JSON Web Tokens), which will power authentication in later lessons.

Understanding Password Hashing

Hashing is a one-way transformation of a password into a fixed string of random-looking characters. It cannot be reversed back into the original password. It uses a salt (a random value) to ensure that even two identical passwords result in different hashes. It applies multiple iterations of hashing to make brute-force attacks slower. How Do We Use It in This Project? In our project, we use bcrypt, a library specifically designed for password hashing. The logic lives in src/utils/auth.utils.ts: TypeScriptconst BCRYPT_ROUNDS = 10; // reasonable default for demos export function hashPassword(password: string): string { const salt = bcrypt.genSaltSync(BCRYPT_ROUNDS); return bcrypt.hashSync(password, salt); } export function verifyPassword(password: string, passwordHash: string): boolean { try { return bcrypt.compareSync(password, passwordHash); } catch { return false; } } bcrypt.genSaltSync(10) generates a random salt with 10 “rounds” (computational cost factor). bcrypt.hashSync(password, salt) produces the stored password hash. Both the salt and the hash are embedded in the stored string. When verifying a login attempt, bcrypt.compareSync: Extracts the salt from the stored hash. Re-hashes the provided password with that salt. Compares the result to the stored hash. If they match → the password is correct. Why Not Store Plain Passwords? Imagine two users register with the password password123: Plain text: both DB rows show the same string. With bcrypt: each row looks different, because each hash uses a unique salt. This ensures stronger protection against database leaks and precomputed attack tables. Mock DB vs Real DB In our mock DB (mock-db.ts), new users are written back into a TypeScript file using the persistUserSeed function. In a real database (like Postgres or MongoDB), the hashed password would simply be stored in a passwordHash column.

Join the 1M+ learners on CodeSignal

Be a part of our community of 1M+ users who develop and demonstrate their skills on CodeSignal

Implementing the JWT Strategy

To use JWTs in our NestJS application, we define a strategy that tells the framework how to validate tokens. This is handled in src/auth/jwt.strategy.ts.

The JWT Strategy integrates with Passport, a popular authentication middleware. It extracts the token from the Authorization header, verifies it with the secret key, and makes the decoded payload available to the request handler.

TypeScript

// src/auth/jwt.strategy.ts
import { Injectable } from '@nestjs/common';
import { PassportStrategy } from '@nestjs/passport';
import { ExtractJwt, Strategy } from 'passport-jwt';

interface JwtPayload {
  sub: number;
  role: 'user' | 'admin';
}

@Injectable()
export class JwtStrategy extends PassportStrategy(Strategy) {
  constructor() {
    super({
      jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
      ignoreExpiration: false,
      secretOrKey: 'jwt-secret',
    });
  }

  async validate(payload: JwtPayload) {
    return { userId: payload.sub, role: payload.role };
  }
}

// src/auth/jwt.strategy.ts
import { Injectable } from '@nestjs/common';
import { PassportStrategy } from '@nestjs/passport';
import { ExtractJwt, Strategy } from 'passport-jwt';

interface JwtPayload {
  sub: number;
  role: 'user' | 'admin';
}

@Injectable()
export class JwtStrategy extends PassportStrategy(Strategy) {
  constructor() {
    super({
      jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
      ignoreExpiration: false,
      secretOrKey: 'jwt-secret',
    });
  }

  async validate(payload: JwtPayload) {
    return { userId: payload.sub, role: payload.role };
  }
}

Key points:

jwtFromRequest → Extracts the JWT from the Authorization: Bearer <token> header.
ignoreExpiration: false → Ensures expired tokens are rejected.
secretOrKey → The key used to verify the signature. In production, this should be an environment variable.
validate() → Returns the user data (ID and role) from the payload. This becomes available in route handlers via request context.

With this, our API can now authenticate and authorize users based on the token they present.

Implementing the Registration Flow: Service Layer

Let’s build the registration endpoint step by step.

Service Layer

The logic for creating users lives in src/auth/auth.service.ts.

TypeScript

// src/auth/auth.service.ts
import { BadRequestException, Injectable } from '@nestjs/common';
import { DatabaseService } from '../database/database.service';
import { hashPassword, persistUserSeed } from '../utils/auth.utils';
import { JwtService } from '@nestjs/jwt';
import { v4 as uuidv4 } from 'uuid';

@Injectable()
export class AuthService {
  constructor(
    private readonly db: DatabaseService,
    private readonly jwtService: JwtService,
  ) {}

  async register(name: string, username: string, password: string) {
    if (!name || !username || !password) {
      throw new BadRequestException('Missing required fields');
    }
    const users = this.db.getUsers();
    const exists = users.some((u) => u.username === username);
    if (exists) {
      throw new BadRequestException('Username already exists');
    }
    const id = uuidv4();
    const newUser = {
      id,
      name,
      username,
      passwordHash: hashPassword(password),
      role: 'user' as const,
    };
    this.db.getUsers().push(newUser);
    // Persist into src/database/mock-db.ts for course base task continuity
    persistUserSeed(this.db);
    return { message: 'User registered successfully' };
  }
}

// src/auth/auth.service.ts
import { BadRequestException, Injectable } from '@nestjs/common';
import { DatabaseService } from '../database/database.service';
import { hashPassword, persistUserSeed } from '../utils/auth.utils';
import { JwtService } from '@nestjs/jwt';
import { v4 as uuidv4 } from 'uuid';

@Injectable()
export class AuthService {
  constructor(
    private readonly db: DatabaseService,
    private readonly jwtService: JwtService,
  ) {}

  async register(name: string, username: string, password: string) {
    if (!name || !username || !password) {
      throw new BadRequestException('Missing required fields');
    }
    const users = this.db.getUsers();
    const exists = users.some((u) => u.username === username);
    if (exists) {
      throw new BadRequestException('Username already exists');
    }
    const id = uuidv4();
    const newUser = {
      id,
      name,
      username,
      passwordHash: hashPassword(password),
      role: 'user' as const,
    };
    this.db.getUsers().push(newUser);
    // Persist into src/database/mock-db.ts for course base task continuity
    persistUserSeed(this.db);
    return { message: 'User registered successfully' };
  }
}

What’s happening here?

Validation → checks that name, username, and password are provided.
Duplicate prevention → rejects if the username already exists.
Password hashing → securely hashes the password before storing.
Persistence → updates the in-memory users list and writes it back to mock-db.ts.

Introducing JWT (JSON Web Tokens)

Now that we can securely register users, the next question is: how will they log in and stay authenticated? This is where JWTs come in.

What is a JWT?

A JWT (JSON Web Token) is a compact, digitally signed string used to prove a user’s identity.
It has three parts:

Header – specifies the algorithm and token type.
Payload – contains claims like user ID, role, or expiration time.
Signature – verifies that the token hasn’t been tampered with.

Example (simplified)

text

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9
.eyJzdWIiOjIsInJvbGUiOiJ1c2VyIiwiZXhwIjoxNzM2OTQ1MDB9
.VhLgSkKqzW9Qz5hL2o3v2jkl1_sFhVQHkz4wz_c7T9A

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9
.eyJzdWIiOjIsInJvbGUiOiJ1c2VyIiwiZXhwIjoxNzM2OTQ1MDB9
.VhLgSkKqzW9Qz5hL2o3v2jkl1_sFhVQHkz4wz_c7T9A

Structure of a JWT:

Header → algorithm + type
Payload → claims like user ID (sub), role, expiration time
Signature → cryptographic proof that the token is valid

Format: <base64(header)>.<base64(payload)>.<signature>

What Information Does It Store?

User ID → so the server knows who’s logged in.
Role → so the API can enforce permissions.
Expiration → so tokens eventually expire.

When a user logs out and logs back in:

A new token is generated.
The payload (like sub and role) remains the same.
The expiration and signature change, making it a new token.

How Does It Work?

When a user logs in (we’ll cover this in the next lesson), the server checks their credentials.
If valid, the server signs a JWT with a secret key and sends it back.
The client (e.g., frontend app) stores this token (commonly in memory or local storage).
For every subsequent request, the client includes the JWT in the Authorization header: Authorization: Bearer <token>
The server verifies the token’s signature and extracts the user info.

Why JWTs Are Important

They eliminate the need to send the password with every request.
They are stateless → the server doesn’t need to remember sessions.
They can include user roles or permissions directly in the payload.

⚠️ In this lesson, we only introduce JWTs but don’t use them yet. We will implement JWT-based login in the next unit.

Introduction: The Importance of Secure User Registration

Why is this important?

Understanding Password Hashing

Join the 1M+ learners on CodeSignal

Seeding Users in the Mock Database

Implementing the JWT Strategy

Setting Up the Auth Module

Implementing the Registration Flow: Service Layer

Implementing the Registration Flow: Controller Layer

Testing Registration

Introducing JWT (JSON Web Tokens)

Summary