Questions
6 of 6
1How do you implement a @Public() decorator to skip a global auth guard for specific routes in NestJS?
2What is a guard in NestJS and when should you use one over middleware?
3How do you write a single guard that works across both HTTP and WebSocket transports in NestJS?
4How does the request lifecycle behave differently for WebSocket gateways vs HTTP controllers in NestJS?
5How do you implement role-based access control (RBAC) with a guard and Reflector in NestJS?
6What does a guard return when it needs to deny the request and how can it throw a custom exception in NestJS?
NestJSNestJS
Basics
Modules
Decorators
Controllers
Dependency Injection
Providers
Architecture
Request Lifecycle
Middleware
Guards
Interceptors
Pipes
Filters
Exception Handling
API Design
GraphQL
Database and ORM
Microservices
Authentication and Authorization
06 / 06

What does a guard return when it needs to deny the request and how can it throw a custom exception in NestJS?

Returning false causes NestJS to throw a default ForbiddenException (403). To return a different status code or message, throw explicitly inside canActivate(). Throwing directly gives full control over the HTTP status and error message — prefer this over returning false in production guards.

Guard with explicit exception throwing
return false vs throw — when to use each:
  1. 1

    return false — NestJS throws a generic ForbiddenException(403) with no custom message.

  2. 2

    throw new UnauthorizedException() — returns 401 with a custom message.

  3. 3

    throw new ForbiddenException('Reason') — returns 403 with a descriptive reason.

  4. 4

    Always prefer explicit throws in production — clients need meaningful error messages.

  5. 5

    Custom exceptions extending HttpException are also valid inside guards.