NestJs authorize/validate user owns resource

user_16998138 0
Viewed 287

What is the standard way of validating/authorizing that a user has access to a resource?

For example: a user can PUT comment/:id to update a comment, and I want to check if the user is allowed to.

Guards aren't ideal because they run before any validation and I need to access the comment id.

I've also tried a custom Param pipe but I'm struggling to access the request execution context from it to get the user.

Finally I could also just put the logic in the controller.

This seems like a pretty common use case so I was wondering: how does this typically get solved?

nestjs
1 Answers

A common practice is to use OAuth 2 framework. Each valid user will have associated accesstoken that will be validated in the server before the user is allowed to access resource.

For NestJs Framework, you can checkout the official documentation on how to achieve this. https://docs.nestjs.com/security/authorization

user_46108930
Related