Skillshub nestjs-security

Authentication, RBAC, and Hardening standards. Use when implementing JWT auth, RBAC guards, or security hardening in NestJS. (triggers: **/*.guard.ts, **/*.strategy.ts, **/auth/**, Passport, JWT, AuthGuard, CSRF, Helmet)

install

source · Clone the upstream repo

git clone https://github.com/ComeOnOliver/skillshub

Claude Code · Install into ~/.claude/skills/

T=$(mktemp -d) && git clone --depth=1 https://github.com/ComeOnOliver/skillshub "$T" && mkdir -p ~/.claude/skills && cp -r "$T/skills/HoangNguyen0403/agent-skills-standard/nestjs-security" ~/.claude/skills/comeonoliver-skillshub-nestjs-security && rm -rf "$T"

manifest: skills/HoangNguyen0403/agent-skills-standard/nestjs-security/SKILL.md

source content

NestJS Security Standards

Priority: P0 (CRITICAL)

Authentication (JWT)

Strategy: Use
```
@nestjs/passport
```
with
```
passport-jwt
```
.
Algorithm: Enforce
```
RS256
```
(preferred) or
```
HS256
```
. Reject
none
.
Claims: Validate
```
iss
```
and
```
aud
```
.
Tokens: Short access (15m), Long httponly refresh (7d).
MFA: Require 2FA for admin panels.

Authorization (RBAC)

Deny by default: Bind
```
AuthGuard
```
globally (APP_GUARD).
Bypass: Create
```
@Public()
```
decorator for open routes.
Roles: Use
```
Reflector.getAllAndOverride
```
for Method/Class merge.

Cryptography

Hashing: Use Argon2id, not Bcrypt. See implementation.
Encryption: Use AES-256-GCM with KMS rotation. See implementation.

Hardening

Helmet: Mandatory. Enable HSTS, CSP.
CORS: Explicit origins only. No
```
*
```
.
Throttling: Use Redis-backed
```
@nestjs/throttler
```
in production.
CSRF: Required for cookie-based auth. See implementation.

Data Protection

Sanitization: Use
```
ClassSerializerInterceptor
```
+
```
@Exclude()
```
.
Validation:
```
ValidationPipe({ whitelist: true })
```
to prevent mass assignment.
Audit: Log mutations (Who, What, When). See implementation.

Secrets Management

CI/CD: Run
```
npm audit --prod
```
in pipelines.
Runtime: Inject via vault (AWS Secrets Manager / HashiCorp Vault), not
```
.env
```
.

Anti-Patterns

No Shadow APIs: Audit routes regularly; disable
```
/docs
```
in production.
No SSRF: Allowlist domains for all outgoing HTTP requests.
No SQLi: Use ORM; avoid raw
```
query()
```
with string concatenation.
No XSS: Sanitize HTML input with
```
dompurify
```
.