How do you add authorization guards to GraphQL resolvers in NestJS?

Q: How do you add authorization guards to GraphQL resolvers in NestJS?

@Injectable() export class GqlAuthGuard implements CanActivate { constructor(private jwtService: JwtService, private reflector: Reflector) {} canActivate(context: ExecutionContext): boolean { const ctx = GqlExecutionContext.create(context); const req = ctx.getContext ().req; const isPublic = this.reflector.getAllAndOverride ('isPublic', [ context.getHandler(), context.getClass(), ]); if (isPublic) return true; const token = req.headers.authorization?.split(' ')[1]; if (!token) throw new UnauthorizedException(); req.user = this.jwtService.verify(token); return true; } } // Per-resolver application @UseGuards(GqlAuthGuard) @Query(() => User) me(@CurrentUser() user: User) { return user; } // Skip auth on a specific query @Public() @Query(() => [Post]) publicPosts() { return this.postsService.findPublished(); } GqlExecutionContext.create(context) is mandatory — switchToHttp() returns undefined in GraphQL. ctx.getContext().req gives access to the HTTP request forwarded in the GraphQLModule context factory. Register guards globally via APP_GUARD token so all resolvers are protected by default. Use @Public() + Reflector for opt-out public queries — safer than whitelisting routes. GqlExecutionContext works in guards, interceptors, and exception filters for GraphQL resolvers.

Difficulty: 5/10

Guards, Authorization, GraphQL

Guards on GraphQL resolvers must use GqlExecutionContext.create(context) to access the GraphQL context — ctx.switchToHttp() returns undefined in a GraphQL resolver. Apply guards with @UseGuards() on the resolver method or class. Combine with @Public() and Reflector for opt-out public routes.

GQL auth guard and per-resolver application

GraphQL guard implementation rules:

1
GqlExecutionContext.create(context) is mandatory — switchToHttp() returns undefined in GraphQL.
2
ctx.getContext().req gives access to the HTTP request forwarded in the GraphQLModule context factory.

How do you add authorization guards to GraphQL resolvers in NestJS?

Difficulty: 5/10

Guards, Authorization, GraphQL

Guards on GraphQL resolvers must use GqlExecutionContext.create(context) to access the GraphQL context — ctx.switchToHttp() returns undefined in a GraphQL resolver. Apply guards with @UseGuards() on the resolver method or class. Combine with @Public() and Reflector for opt-out public routes.

GQL auth guard and per-resolver application

GraphQL guard implementation rules:

1
GqlExecutionContext.create(context) is mandatory — switchToHttp() returns undefined in GraphQL.
2
ctx.getContext().req gives access to the HTTP request forwarded in the GraphQLModule context factory.

How do you add authorization guards to GraphQL resolvers in NestJS?

Guards on GraphQL resolvers must use GqlExecutionContext.create(context) to access the GraphQL context — ctx.switchToHttp() returns undefined in a GraphQL resolver. Apply guards with @UseGuards() on the resolver method or class. Combine with @Public() and Reflector for opt-out public routes.

How do you add authorization guards to GraphQL resolvers in NestJS?

Guards on GraphQL resolvers must use GqlExecutionContext.create(context) to access the GraphQL context — ctx.switchToHttp() returns undefined in a GraphQL resolver. Apply guards with @UseGuards() on the resolver method or class. Combine with @Public() and Reflector for opt-out public routes.

Scenario Questions

Follow-up Questions