Use `@nestjs/passport` with `passport-jwt`, enforce a signed algorithm such as RS256, and validate issuer and audience in the strategy. Register authentication globally as an `APP_GUARD`, then mark only deliberate public routes with a `@Public()` decorator. Access tokens should be short-lived (for example 15 minutes); keep refresh tokens long-lived and HTTP-only when cookie-based. Reject `none`, keep signing secrets/keys in a vault, and test unauthenticated requests return 401. Add Helmet, ex...
Installs into .claude/skills of the current project.
Are you the author of Nestjs Security?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/hoangnguyen0403-nestjs-security-agent-skills-standard)
Use `@nestjs/passport` with `passport-jwt`, enforce a signed algorithm such as RS256, and validate issuer and audience in the strategy. Register authentication globally as an `APP_GUARD`, then mark only deliberate public routes with a `@Public()` decorator.
Access tokens should be short-lived (for example 15 minutes); keep refresh tokens long-lived and HTTP-only when cookie-based. Reject `none`, keep signing secrets/keys in a vault, and test unauthenticated requests return 401. Add Helmet, explicit CORS origins, throttling, `ValidationPipe({ whitelist: true })`, and Argon2id password hashing as part of the application security baseline.
