Questions
2 of 6
1How do you implement a @Public() decorator to skip a global auth guard for specific routes in NestJS?
2What is a guard in NestJS and when should you use one over middleware?
3How do you write a single guard that works across both HTTP and WebSocket transports in NestJS?
4How does the request lifecycle behave differently for WebSocket gateways vs HTTP controllers in NestJS?
5How do you implement role-based access control (RBAC) with a guard and Reflector in NestJS?
6What does a guard return when it needs to deny the request and how can it throw a custom exception in NestJS?
NestJSNestJS
Basics
Modules
Decorators
Controllers
Dependency Injection
Providers
Architecture
Request Lifecycle
Middleware
Guards
Interceptors
Pipes
Filters
Exception Handling
API Design
GraphQL
Database and ORM
Microservices
Authentication and Authorization
02 / 06

What is a guard in NestJS and when should you use one over middleware?

A guard implements CanActivate and returns a boolean to allow or block a request. Unlike middleware, guards run after routing — they know which controller and handler will process the request, enabling metadata-driven authorization decisions. Use guards for auth; use middleware for transport-level concerns that don't depend on the route.

Basic JWT auth guard
Guards vs middleware — decision guide:
  1. 1

    Guards — run after routing; know the target handler; can read @SetMetadata() via Reflector.

  2. 2

    Middleware — run before routing; cannot read route metadata; suited for request preprocessing.

  3. 3

    Use guards for: JWT verification, RBAC, API key validation, subscription checks.

  4. 4

    Use middleware for: logging, CORS, body parsing, session hydration, rate limiting.

  5. 5

    Guards can return boolean, Promise<boolean>, or Observable<boolean>.