NestJS 9: Enforcing Least‑Privilege Authentication with Expired Tokens

Goal

Implement a strategy that guarantees least‑privilege access when a JWT is expired or revoked in a NestJS 9 application.

Constraints & Uncertainty

• NestJS ships only a JwtStrategy that validates expiration but offers no built‑in revocation list.
• RolesGuard grants access if *any* role matches the @Roles decorator, yet it cannot detect whether the token was revoked or simply expired.
• There is no standard configuration to distinguish between expired, revoked, or malformed tokens in AuthGuard’s UnauthorizedException.

Unresolved Decision

What is the optimal revocation mechanism that integrates cleanly with NestJS’s guard pipeline while preserving the least‑privilege model?

Questions

• What configuration options exist in JwtStrategy to emit distinct errors for expired versus revoked tokens?
• How can RolesGuard be extended to deny access when a token is on a revocation list?
• What is the recommended persistence layer (e.g., Redis, DB) for storing revoked JWT identifiers in a NestJS 9 application?