Questions
3 of 6
1How do you implement a @Public() decorator to skip a global auth guard for specific routes in NestJS?
2What is a guard in NestJS and when should you use one over middleware?
3How do you write a single guard that works across both HTTP and WebSocket transports in NestJS?
4How does the request lifecycle behave differently for WebSocket gateways vs HTTP controllers in NestJS?
5How do you implement role-based access control (RBAC) with a guard and Reflector in NestJS?
6What does a guard return when it needs to deny the request and how can it throw a custom exception in NestJS?
NestJSNestJS
Basics
Modules
Decorators
Controllers
Dependency Injection
Providers
Architecture
Request Lifecycle
Middleware
Guards
Interceptors
Pipes
Filters
Exception Handling
API Design
GraphQL
Database and ORM
Microservices
Authentication and Authorization
03 / 06

How do you write a single guard that works across both HTTP and WebSocket transports in NestJS?

Use ctx.getType() to detect the current transport and branch accordingly. For HTTP, extract the token from the Authorization header. For WebSocket, extract it from client.handshake.auth or handshake headers. Return true if verification succeeds, throw the transport-appropriate exception if not.

Universal auth guard for HTTP and WebSocket
Multi-transport guard design notes:
  1. 1

    ctx.getType() returns 'http', 'ws', or 'rpc' — always check before switching context.

  2. 2

    WebSocket tokens come from handshake.auth (Socket.IO) or handshake.headers.

  3. 3

    Store user on client.data.user for WebSocket — equivalent to req.user for HTTP.

  4. 4

    Throw WsException for WebSocket errors, not HttpException — they serialize differently.

  5. 5

    For microservice RPC use ctx.switchToRpc().getData() to access the message payload.