What is a guard in NestJS and when should you use one over middleware?
A guard implements CanActivate and returns a boolean to allow or block a request. Unlike middleware, guards run after routing — they know which controller and handler will process the request, enabling metadata-driven authorization decisions. Use guards for auth; use middleware for transport-level concerns that don't depend on the route.
- 1
Guards — run after routing; know the target handler; can read @SetMetadata() via Reflector.
- 2
Middleware — run before routing; cannot read route metadata; suited for request preprocessing.
- 3
Use guards for: JWT verification, RBAC, API key validation, subscription checks.
- 4
Use middleware for: logging, CORS, body parsing, session hydration, rate limiting.
- 5
Guards can return boolean, Promise<boolean>, or Observable<boolean>.
Scenario Questions
0-2 years experience
- 1You need to protect a route that creates a new order so only logged‑in users can access it. How would you implement this using a guard instead of middleware?
- 2If you placed authentication logic in a global middleware but later notice it runs for static asset requests, what would you change and why would a guard be a better fit?
2-5 years experience
- 1During a sprint you added a role‑based guard to the admin controller, but requests are still reaching the handler even when the user lacks the role. Walk me through how you'd debug this.
- 2We have a feature that validates JWTs and also logs request timing. Should we combine these concerns in a single guard, split them, or use middleware for one of them? Explain your trade‑offs.
5-8 years experience
- 1Our microservice gateway needs to enforce rate limiting and permission checks before forwarding to downstream services. How would you decide which parts belong in a guard versus middleware, considering performance and scalability?
- 2When scaling to thousands of concurrent requests, what impact does using guards (which run after middleware) have on request latency, and how would you mitigate any overhead?
8+ years experience
- 1A legacy monolith is being migrated to NestJS. Existing authentication is implemented as Express middleware. How would you plan the migration to guards while ensuring minimal disruption across multiple teams?
- 2Across several services we need a consistent authorization model that can be updated centrally. Describe an architecture using custom guards that supports this, and discuss how you'd handle versioning and backward compatibility.
Follow-up Questions
- Can you walk me through the order NestJS executes middleware, guards, interceptors, and pipes?
- What limitations do guards have when you need to modify the response body?
- How does the DI system differ between a guard and a middleware?