Google login in NestJS: a practical guide for developers

npm install @nestjs/passport passport-google-oauth20 passport @nestjs/jwt
npm install -D @types/passport-google-oauth20

// auth/strategies/google.strategy.ts
import { Injectable } from '@nestjs/common';
import { PassportStrategy } from '@nestjs/passport';
import { Strategy, VerifyCallback } from 'passport-google-oauth20';

@Injectable()
export class GoogleStrategy extends PassportStrategy(Strategy, 'google') {
  constructor() {
    super({
      clientID: process.env.GOOGLE_CLIENT_ID,
      clientSecret: process.env.GOOGLE_CLIENT_SECRET,
      callbackURL: process.env.GOOGLE_CALLBACK_URL, // e.g., http://localhost:3000/auth/google/callback
      scope: ['email', 'profile'],
    });
  }

  async validate(
    accessToken: string,
    refreshToken: string,
    profile: any,
    done: VerifyCallback,
  ) {
    // This callback is invoked after Google verifies the user
    // profile contains: id, emails, displayName, photos
    const { id, displayName, emails, photos } = profile;
    const email = emails[0].value;

    const user = {
      googleId: id,
      email,
      name: displayName,
      avatar: photos[0]?.value,
      accessToken,
      refreshToken,
    };

    done(null, user);
  }
}

// auth/auth.controller.ts
import { Controller, Get, UseGuards, Req, Res } from '@nestjs/common';
import { AuthGuard } from '@nestjs/passport';
import { Request, Response } from 'express';
import { AuthService } from './auth.service';

@Controller('auth')
export class AuthController {
  constructor(private authService: AuthService) {}

  @Get('google')
  @UseGuards(AuthGuard('google'))
  async googleAuth() {
    // Passport redirects to Google automatically
  }

  @Get('google/callback')
  @UseGuards(AuthGuard('google'))
  async googleCallback(@Req() req: Request, @Res() res: Response) {
    // After Google redirects back, req.user contains the profile data
    const { accessToken, refreshToken } = await this.authService.handleGoogleLogin(
      req.user,
    );

    // Redirect to frontend with tokens in query string or secure cookie
    res.redirect(
      `${process.env.FRONTEND_URL}/auth/success?accessToken=${accessToken}&refreshToken=${refreshToken}`,
    );
  }
}

// auth/auth.service.ts
import { Injectable, BadRequestException } from '@nestjs/common';
import { JwtService } from '@nestjs/jwt';
import { UsersService } from '../users/users.service';

@Injectable()
export class AuthService {
  constructor(
    private usersService: UsersService,
    private jwtService: JwtService,
  ) {}

  async handleGoogleLogin(googleProfile: any) {
    const { email, googleId, name, avatar } = googleProfile;

    // Email is verified by Google, so it's safe to use as the lookup key
    if (!email) {
      throw new BadRequestException('Google profile missing email');
    }

    let user = await this.usersService.findByEmail(email);

    if (!user) {
      // Create new user from Google profile
      user = await this.usersService.create({
        email,
        name,
        avatar,
        googleId,
        authProvider: 'google',
      });
    } else {
      // Update existing user with fresh Google data
      // (in case they changed profile picture, etc.)
      await this.usersService.update(user.id, {
        googleId,
        name,
        avatar,
      });
    }

    // Issue your own JWT tokens
    const { accessToken, refreshToken } = this.issueTokens(user);

    return { accessToken, refreshToken, user };
  }

  private issueTokens(user: any) {
    const payload = { sub: user.id, email: user.email };

    const accessToken = this.jwtService.sign(payload, {
      expiresIn: '15m',
    });

    const refreshToken = this.jwtService.sign(payload, {
      expiresIn: '7d',
    });

    return { accessToken, refreshToken };
  }
}

// auth/auth.controller.ts (refined)
@Get('google/callback')
@UseGuards(AuthGuard('google'))
async googleCallback(@Req() req: Request, @Res() res: Response) {
  const { accessToken, refreshToken } = await this.authService.handleGoogleLogin(
    req.user,
  );

  // Set secure cookies instead of query params
  res.cookie('accessToken', accessToken, {
    httpOnly: true,
    secure: process.env.NODE_ENV === 'production',
    sameSite: 'strict',
    maxAge: 15 * 60 * 1000, // 15 minutes
  });

  res.cookie('refreshToken', refreshToken, {
    httpOnly: true,
    secure: process.env.NODE_ENV === 'production',
    sameSite: 'strict',
    maxAge: 7 * 24 * 60 * 60 * 1000, // 7 days
  });

  // Redirect to a safe success page
  res.redirect(`${process.env.FRONTEND_URL}/dashboard`);
}

async handleGoogleLogin(googleProfile: any) {
  const { email, googleId, name, avatar, emails } = googleProfile;

  // 1. Verify email exists
  if (!email) {
    throw new BadRequestException('Google profile missing email');
  }

  // 2. Verify email is marked as verified by Google
  const primaryEmail = emails?.find((e: any) => e.verified === true);
  if (!primaryEmail) {
    throw new BadRequestException('Google email is not verified');
  }

  // 3. Validate email format on your side (extra layer)
  const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
  if (!emailRegex.test(email)) {
    throw new BadRequestException('Invalid email format');
  }

  // 4. Check for suspicious domains (optional but good practice)
  const blockedDomains = ['tempmail.com', 'guerrillamail.com'];
  const domain = email.split('@')[1];
  if (blockedDomains.includes(domain)) {
    throw new BadRequestException('Temporary email addresses not allowed');
  }

  // Proceed with user lookup/creation only after all checks
  let user = await this.usersService.findByEmail(email);
  // ...rest of logic
}