authentication-authorization

Authentication and authorization for NestJS APIs on Fastify - secure-by-default global guard with @Public(), session vs JWT tradeoffs, OIDC/OAuth2 via an IdP, JWT validation and JWKS key rotation, short-lived access and rotating hashed refresh tokens, argon2id password hashing, MFA hooks, API keys and service-to-service auth, cookie and CSRF settings, logout and revocation, RBAC vs ABAC, default-deny guards with Reflector, object-level authorization (BOLA/IDOR), tenant isolation, WebSocket and SSE auth, and 401 vs 403 testing. Load when adding login or tokens, writing guards, changing access control, or reviewing who can reach which data.