What does a guard return when it needs to deny the request and how can it throw a custom exception in NestJS?

Q: What does a guard return when it needs to deny the request and how can it throw a custom exception in NestJS?

canActivate(ctx: ExecutionContext): boolean { const req = ctx.switchToHttp().getRequest(); const token = req.headers.authorization?.split(' ')[1]; if (!token) { throw new UnauthorizedException('No token provided'); // 401 } try { req.user = this.jwt.verify(token); return true; } catch (e) { if (e.name === 'TokenExpiredError') { throw new UnauthorizedException('Token has expired'); } throw new UnauthorizedException('Invalid token'); } } return false — NestJS throws a generic ForbiddenException(403) with no custom message. throw new UnauthorizedException() — returns 401 with a custom message. throw new ForbiddenException('Reason') — returns 403 with a descriptive reason. Always prefer explicit throws in production — clients need meaningful error messages. Custom exceptions extending HttpException are also valid inside guards.

Difficulty: 4/10

Guards, Exception handling, NestJS

Returning false causes NestJS to throw a default ForbiddenException (403). To return a different status code or message, throw explicitly inside canActivate(). Throwing directly gives full control over the HTTP status and error message — prefer this over returning false in production guards.

Guard with explicit exception throwing

return false vs throw — when to use each:

1
return false — NestJS throws a generic ForbiddenException(403) with no custom message.
2
throw new UnauthorizedException() — returns 401 with a custom message.
3
throw new ForbiddenException('Reason') — returns 403 with a descriptive reason.
4
Always prefer explicit throws in production — clients need meaningful error messages.
5
Custom exceptions extending HttpException are also valid inside guards.

Scenario Questions

0-2 years experience

1You need a guard that blocks unauthenticated users from a simple controller. How would you code the guard to deny the request?
2If a guard returns false, what HTTP response does the client receive by default?
3Show me how you would change the guard so it returns a 403 with a custom message instead of just false.

Follow-up Questions

What does Nest do internally when a guard returns false versus when it throws an exception?
How would you expose additional error details without leaking internal implementation?
Can you describe how exception filters interact with guard‑thrown errors?