How do you write a single guard that works across both HTTP and WebSocket transports in NestJS?

Q: How do you write a single guard that works across both HTTP and WebSocket transports in NestJS?

@Injectable() export class UniversalAuthGuard implements CanActivate { constructor(private jwt: JwtService) {} canActivate(ctx: ExecutionContext): boolean { const type = ctx.getType (); if (type === 'http') { const req = ctx.switchToHttp().getRequest(); const token = req.headers.authorization?.split(' ')[1]; if (!token) throw new UnauthorizedException('No token'); req.user = this.jwt.verify(token); return true; } if (type === 'ws') { const client = ctx.switchToWs().getClient (); const token = client.handshake.auth?.token || client.handshake.headers?.authorization?.split(' ')[1]; if (!token) throw new WsException('Unauthorized'); client.data.user = this.jwt.verify(token); // store on socket.data return true; } return true; // allow RPC by default } } ctx.getType() returns 'http', 'ws', or 'rpc' — always check before switching context. WebSocket tokens come from handshake.auth (Socket.IO) or handshake.headers. Store user on client.data.user for WebSocket — equivalent to req.user for HTTP. Throw WsException for WebSocket errors, not HttpException — they serialize differently. For microservice RPC use ctx.switchToRpc().getData() to access the message payload.

Difficulty: 6/10

NestJS guards, transport‑agnostic implementation, WebSocket vs HTTP context

Use ctx.getType() to detect the current transport and branch accordingly. For HTTP, extract the token from the Authorization header. For WebSocket, extract it from client.handshake.auth or handshake headers. Return true if verification succeeds, throw the transport-appropriate exception if not.

Universal auth guard for HTTP and WebSocket

Multi-transport guard design notes:

1
ctx.getType() returns 'http', 'ws', or 'rpc' — always check before switching context.
2

How do you write a single guard that works across both HTTP and WebSocket transports in NestJS?

Difficulty: 6/10

NestJS guards, transport‑agnostic implementation, WebSocket vs HTTP context

Use ctx.getType() to detect the current transport and branch accordingly. For HTTP, extract the token from the Authorization header. For WebSocket, extract it from client.handshake.auth or handshake headers. Return true if verification succeeds, throw the transport-appropriate exception if not.

Universal auth guard for HTTP and WebSocket

Multi-transport guard design notes:

1
ctx.getType() returns 'http', 'ws', or 'rpc' — always check before switching context.
2

How do you write a single guard that works across both HTTP and WebSocket transports in NestJS?

Use ctx.getType() to detect the current transport and branch accordingly. For HTTP, extract the token from the Authorization header. For WebSocket, extract it from client.handshake.auth or handshake headers. Return true if verification succeeds, throw the transport-appropriate exception if not.

How do you write a single guard that works across both HTTP and WebSocket transports in NestJS?

Use ctx.getType() to detect the current transport and branch accordingly. For HTTP, extract the token from the Authorization header. For WebSocket, extract it from client.handshake.auth or handshake headers. Return true if verification succeeds, throw the transport-appropriate exception if not.

Scenario Questions

Follow-up Questions