Questions
1 of 6
1How do you implement a @Public() decorator to skip a global auth guard for specific routes in NestJS?
2What is a guard in NestJS and when should you use one over middleware?
3How do you write a single guard that works across both HTTP and WebSocket transports in NestJS?
4How does the request lifecycle behave differently for WebSocket gateways vs HTTP controllers in NestJS?
5How do you implement role-based access control (RBAC) with a guard and Reflector in NestJS?
6What does a guard return when it needs to deny the request and how can it throw a custom exception in NestJS?
NestJSNestJS
Basics
Modules
Decorators
Controllers
Dependency Injection
Providers
Architecture
Request Lifecycle
Middleware
Guards
Interceptors
Pipes
Filters
Exception Handling
API Design
GraphQL
Database and ORM
Microservices
Authentication and Authorization
01 / 06

How do you implement a @Public() decorator to skip a global auth guard for specific routes in NestJS?

Define @Public() using SetMetadata with a known key. In the global auth guard, use Reflector.getAllAndOverride() to check for the isPublic flag first — if true, bypass authentication entirely. This is the canonical pattern used in virtually every production NestJS auth setup.

Complete @Public() decorator and guard implementation
Why this pattern is preferred over whitelisting routes:
  1. 1

    Opt-in public routes are safer — all routes are protected by default.

  2. 2

    @Public() is co-located with the route — easier to audit than a centralized whitelist.

  3. 3

    Works at both method and class level — @Public() on the controller marks all its routes as public.

  4. 4

    No need to maintain a list of excluded paths in the guard or middleware configuration.