What is the difference between AuthGuard('jwt') from Passport and writing a custom JwtAuthGuard in NestJS?

Q: What is the difference between AuthGuard('jwt') from Passport and writing a custom JwtAuthGuard in NestJS?

// Option 1 — direct AuthGuard (limited) @UseGuards(AuthGuard('jwt')) @Get('profile') getProfile(@Request() req) { return req.user; } // Option 2 — extended guard (preferred in production) @Injectable() export class JwtAuthGuard extends AuthGuard('jwt') { constructor(private reflector: Reflector) { super(); } canActivate(ctx: ExecutionContext): boolean | Promise | Observable { const isPublic = this.reflector.getAllAndOverride ('isPublic', [ ctx.getHandler(), ctx.getClass(), ]); if (isPublic) return true; // bypass for @Public() routes return super.canActivate(ctx); // delegate to Passport } // Customize error message from Passport info handleRequest(err: any, user: any, info: any) { if (err || !user) { throw err ?? new UnauthorizedException(info?.message ?? 'Unauthorized'); } return user; } } handleRequest() — override to convert Passport's info object into a clear error message. Reflector access — read @Public() and other metadata to implement opt-out public routes. Pre/post logic — add rate limiting, IP checks, or audit logging around the Passport call. Consistent error handling — all auth failures produce the same structured error response. The custom guard is registered once globally via APP_GUARD — no per-route annotation needed.

Difficulty: 5/10

AuthGuard vs custom guard, Passport integration, NestJS guard lifecycle

AuthGuard('jwt') is a built-in guard that directly delegates to the JwtStrategy. A custom JwtAuthGuard extends AuthGuard('jwt') to add extra logic: checking @Public() via Reflector to skip auth on specific routes, and overriding handleRequest() to produce better error messages. The custom guard is always preferred in production.

Custom JwtAuthGuard with @Public() support

Reasons to extend AuthGuard rather than use it directly:

1
handleRequest() — override to convert Passport's info object into a clear error message.
2

What is the difference between AuthGuard('jwt') from Passport and writing a custom JwtAuthGuard in NestJS?

Difficulty: 5/10

AuthGuard vs custom guard, Passport integration, NestJS guard lifecycle

AuthGuard('jwt') is a built-in guard that directly delegates to the JwtStrategy. A custom JwtAuthGuard extends AuthGuard('jwt') to add extra logic: checking @Public() via Reflector to skip auth on specific routes, and overriding handleRequest() to produce better error messages. The custom guard is always preferred in production.

Custom JwtAuthGuard with @Public() support

Reasons to extend AuthGuard rather than use it directly:

1
handleRequest() — override to convert Passport's info object into a clear error message.
2

What is the difference between AuthGuard('jwt') from Passport and writing a custom JwtAuthGuard in NestJS?

What is the difference between AuthGuard('jwt') from Passport and writing a custom JwtAuthGuard in NestJS?

Scenario Questions

Follow-up Questions