How do you implement a @Public() decorator to skip a global auth guard for specific routes in NestJS?

Question

Accepted Answer

// 1. Define the decorator
export const IS_PUBLIC_KEY = 'isPublic';
export const Public = () => SetMetadata(IS_PUBLIC_KEY, true);

// 2. Check it in the global auth guard
@Injectable()
export class GlobalAuthGuard implements CanActivate {
  constructor(private reflector: Reflector, private jwt: JwtService) {}

canActivate(ctx: ExecutionContext): boolean {
    const isPublic = this.reflector.getAllAndOverride<boolean>(IS_PUBLIC_KEY, [
      ctx.getHandler(),
      ctx.getClass(),
    ]);
    if (isPublic) return true; // bypass auth entirely

const req = ctx.switchToHttp().getRequest();
    const token = req.headers.authorization?.split(' ')[1];
    if (!token) throw new UnauthorizedException();
    req.user = this.jwt.verify(token);
    return true;
  }
}

// 3. Register globally and use on public routes
// providers: [{ provide: APP_GUARD, useClass: GlobalAuthGuard }]

@Public()
@Post('login')
login(@Body() dto: LoginDto) {} Opt-in public routes are safer — all routes are protected by default. @Public() is co-located with the route — easier to audit than a centralized whitelist. Works at both method and class level — @Public() on the controller marks all its routes as public. No need to maintain a list of excluded paths in the guard or middleware configuration.

How do you implement a @Public() decorator to skip a global auth guard for specific routes in NestJS?

Define @Public() using SetMetadata with a known key. In the global auth guard, use Reflector.getAllAndOverride() to check for the isPublic flag first — if true, bypass authentication entirely. This is the canonical pattern used in virtually every production NestJS auth setup.

How do you implement a @Public() decorator to skip a global auth guard for specific routes in NestJS?

Define @Public() using SetMetadata with a known key. In the global auth guard, use Reflector.getAllAndOverride() to check for the isPublic flag first — if true, bypass authentication entirely. This is the canonical pattern used in virtually every production NestJS auth setup.

Scenario Questions

Follow-up Questions