title: NestJs/Angular/Cognito flow
body: <p>The Authentication and Authorization flows are difficult to get right without concrete examples. NestJs doc has a good example for JWT tokens, however I find it difficult to establish the correct flow.</p>
  
  <p>Here is the closest I have been able to get to solve the authorization flow:</p>
  
  <ol>
  <li>after authentication, store refresh token in DB (which I don't like much but couldn't find an easier way to handle it), send access token to Angular and keep it in local storage or a cookie</li>
  <li>On every request send the access token and check if it's still valid and not close to expiry; if it's expired or about to expire, then go to the DB, get the refresh token and use it to acquire a new access token. I would very much liked to have refresh token stored in a cookie too, but the problem with that is that I don't know how to get more than Authorization header when implementing the JwtStrategy, and what's the best (if any) way to attach the refresh token</li>
  <li>If access token is updated, somehow send it back to the Angular side to be replaced. send the expired time as well so Angular side doesn't replace a newer access token with an older one if there are concurrent requests. But concurrent requests still have a chance of running into a race condition and each, separately, requesting an access token.</li>
  </ol>
  
  <p>There are a bunch of details that are missing in the summary above, but that should give the overall flow that I am trying to implement. The two challenges I have right now is:</p>
  
  <ol>
  <li>The possibility of multiple concurrent requests, all finding out that access token is about to expire and trying to refresh it at once.</li>
  <li>How to add the new access token and expiry timestamp to response header (or body if it should be there), in JwtStrategy itself so the whole auth cycle can be handled with one single annotation/guard.</li>
  </ol>
  
  <p>I appreciate if somebody can help with the above two questions. </p>
  
  <p>Also, I am not sure if it complies with SO policies, but since there is no solid material for the NestJs/Angular/Cognito combination, and since auth is the most important part of a secure webpage. I will be happy to grant some bounties for someone who can put a full working example in github that demonstrates fully how both authentication and authorization (both access and refresh tokens) flows are implemented using best practices.</p>
  
  <p>Finally, here are the best (only?) resources I have found and used so far for NestJs/Cognito combo; none really get to answer the above questions.</p>
  
  <ul>
  <li><a href="https://docs.nestjs.com/techniques/authentication" rel="nofollow noreferrer">https://docs.nestjs.com/techniques/authentication</a></li>
  <li><a href="https://auth0.com/blog/developing-a-secure-api-with-nestjs-adding-authorization/" rel="nofollow noreferrer">https://auth0.com/blog/developing-a-secure-api-with-nestjs-adding-authorization/</a></li>
  <li><a href="https://brightinventions.pl/blog/using-cognito-with-nest-js/" rel="nofollow noreferrer">https://brightinventions.pl/blog/using-cognito-with-nest-js/</a></li>
  </ul>