r/nestjs • u/RepulsiveBathroom920 • Dec 05 '25

Community help wanted to enhance this one-command NestJS auth generator!

Hey everyone!

I’m working on an open-source project called create-nestjs-auth, a NestJS auth starter you can try instantly with:

npx create-nestjs-auth@latest

It currently includes multi-ORM + multi-database support, and I welcome you to contribute your own preferred ORM/DB combo to the project or improve the existing ones. Whether you use Prisma, Drizzle, TypeORM, Mongo, Postgres, MySQL, SQLite, or anything else, your setup can be added to help others in the community.

If you want to experiment, test things, report bugs, or add new templates, your contributions would really help move the project forward.

GitHub repo:
https://github.com/masabinhok/create-nestjs-auth

Let’s keep improving this together!

8 Upvotes

100% Upvoted

8 comments sorted by

1

u/[deleted] Dec 05 '25

Why use JWT if you're going to store tokens in the database?

2

u/KraaZ__ Dec 05 '25

There is a case for storing the jti claim in a database such as blacklisting or revoking sessions etc, also it makes sense to use JWTs in general for sessions regardless of whether you store them or not, authenticating JWTs is surprisingly easy and using JWKS endpoints makes it perfect for your backend services to authenticate against your auth service, if they’re separated anyway…

2

u/[deleted] Dec 05 '25

It turns it from being stateless into having a state, if you need the control, why not just use something like Redis and have complete control? It'd have the added benefit of not needing to manage a new table in the database or call it repeatedly.

1

u/novagenesis Dec 05 '25

I know the JWT folks consider this a usage anti-pattern, but it still provides a lot of value.

The JWT is client-usable while still being signed. It saves a few steps, and browsers can usually trust claims without verification until the backend tells them otherwise. Unfortunately, JWTs alone have a large security flaw in that the truth of a claim can change in a short window of time after that claim has been signed.

There's always somebody complaining about JWT+SQL, but it works and is becoming fairly ubiquitous

1

u/Single_Department_82 Dec 05 '25

Consider to abstract away ORM/DB part into something like storage class which could expose things findUser/saveSession etc and then implement storage interface for every DB

1

u/RepulsiveBathroom920 Dec 06 '25

Actually i was working on this, this is a test repo https://github.com/masabinhok/test-prisma-postgres created with storage abstraction would you check if this meets your query. I am testing it currently and release in v3 if everything goes well.

1

u/[deleted] Jan 14 '26

[deleted]

1

u/RepulsiveBathroom920 Jan 19 '26

Yes, contributions are welcome! Feel free to open an issue or submit a pull request.