Allow to log details about the cause of a 401 error about passport

[Delapouite]

Thanks a lot both of you for your help. As pointed out, the documentation explained it but I wrongly though that this was the default behavior and I did not thought that Passport error could be available in the info var. (I have no suggestion for better naming).

So in the end, I did add this in my codebase for now:

import { Injectable, Logger, UnauthorizedException } from "@nestjs/common";
import { AuthGuard } from "@nestjs/passport";

@Injectable()
export class JwtAuthGuard extends AuthGuard("jwt") {
    private readonly logger = new Logger("JwtAuthGuard");

    handleRequest(err: Error, user: any, info?: Error) {
        if (err || !user) {
            // despite the name, info can be a Passport error, like
            // JsonWebTokenError: jwt audience invalid. expected: foo
            if (info) {
                this.logger.warn(info);
            }

            throw err || new UnauthorizedException();
        }
        return user;
    }
}

Thanks again.

[jmcdo29]

We could possibly add info to the UnauthorizedException if it's not null. Do something like throw err || new UnauthorizedException(info ?? undefined). I've definitely seen a lot of issues with JWT integration based on things like audience or expired tokens that just throws a 401 without more info. This would be helpful for sure

[kamilmysliwiec]

We could possibly add info to the UnauthorizedException if it's not null. Do something like throw err || new UnauthorizedException(info ?? undefined). I've definitely seen a lot of issues with JWT integration based on things like audience or expired tokens that just throws a 401 without more info. This would be helpful for sure

This would be a breaking change.

Could adding an optional logger.error() statement, outputting the content of the info variable (if not empty) be possible?

We could add logger.verbose() call here I guess.

provided to the handleRequest method, but unfortunately it is not used and there does not seem an easy way to retrieve it.

There's a very straightforward way to override the default behavior, check out this section https://docs.nestjs.com/security/authentication#extending-guards