How do you register a global JWT guard so all routes are protected by default in NestJS?

Q: How do you register a global JWT guard so all routes are protected by default in NestJS?

// Register via APP_GUARD — full DI support, can inject Reflector @Module({ providers: [ { provide: APP_GUARD, useClass: JwtAuthGuard, // extended guard that checks @Public() }, ], }) export class AppModule {} // @Public() decorator — opts a route out of authentication export const Public = () => SetMetadata('isPublic', true); // Public routes — no JWT required @Public() @Post('auth/login') login(@Body() dto: LoginDto) {} @Public() @Post('auth/register') register(@Body() dto: RegisterDto) {} @Public() @Get('health') health() { return { status: 'ok' }; } // All other routes are protected automatically — no @UseGuards needed @Get('profile') getProfile(@CurrentUser() user: User) { return user; } APP_GUARD registers the guard inside the DI container — can inject Reflector, ConfigService, and others. app.useGlobalGuards() registers outside DI — cannot inject any services, including Reflector. The @Public() pattern is safer than whitelisting — all routes are secure by default, opt out explicitly. @Public() can be applied at class level to make all routes in a controller public. Multiple APP_GUARD providers can be registered — they run in registration order (global → controller → method).

Difficulty: 6/10

Authentication, Guards, NestJS Global Providers

Register JwtAuthGuard (extended with @Public() support) via the APP_GUARD token so it is managed by the DI container and can inject Reflector. All routes are protected by default. Mark public routes with a @Public() decorator that sets isPublic metadata — the guard reads this and bypasses Passport for those routes.

Global guard registration and @Public() decorator

Global guard registration rules:

1
APP_GUARD registers the guard inside the DI container — can inject Reflector, ConfigService, and others.
2
app.useGlobalGuards() registers outside DI — cannot inject any services, including Reflector.

How do you register a global JWT guard so all routes are protected by default in NestJS?

Difficulty: 6/10

Authentication, Guards, NestJS Global Providers

Register JwtAuthGuard (extended with @Public() support) via the APP_GUARD token so it is managed by the DI container and can inject Reflector. All routes are protected by default. Mark public routes with a @Public() decorator that sets isPublic metadata — the guard reads this and bypasses Passport for those routes.

Global guard registration and @Public() decorator

Global guard registration rules:

1
APP_GUARD registers the guard inside the DI container — can inject Reflector, ConfigService, and others.
2
app.useGlobalGuards() registers outside DI — cannot inject any services, including Reflector.

How do you register a global JWT guard so all routes are protected by default in NestJS?

How do you register a global JWT guard so all routes are protected by default in NestJS?

Scenario Questions

Follow-up Questions