What is a guard in NestJS and when should you use one over middleware?

Q: What is a guard in NestJS and when should you use one over middleware?

@Injectable() export class JwtAuthGuard implements CanActivate { constructor(private jwtService: JwtService) {} canActivate(ctx: ExecutionContext): boolean { const req = ctx.switchToHttp().getRequest(); const token = req.headers.authorization?.split(' ')[1]; if (!token) return false; req.user = this.jwtService.verify(token); return true; } } Guards — run after routing; know the target handler; can read @SetMetadata() via Reflector. Middleware — run before routing; cannot read route metadata; suited for request preprocessing. Use guards for: JWT verification, RBAC, API key validation, subscription checks. Use middleware for: logging, CORS, body parsing, session hydration, rate limiting. Guards can return boolean, Promise , or Observable .

Difficulty: 5/10

authorization, request validation, execution context

A guard implements CanActivate and returns a boolean to allow or block a request. Unlike middleware, guards run after routing — they know which controller and handler will process the request, enabling metadata-driven authorization decisions. Use guards for auth; use middleware for transport-level concerns that don't depend on the route.

Basic JWT auth guard

Guards vs middleware — decision guide:

1
Guards — run after routing; know the target handler; can read @SetMetadata() via Reflector.
2
Middleware — run before routing; cannot read route metadata; suited for request preprocessing.
3
Use guards for: JWT verification, RBAC, API key validation, subscription checks.
4
Use middleware for: logging, CORS, body parsing, session hydration, rate limiting.
5
Guards can return boolean, Promise<boolean>, or Observable<boolean>.

Scenario Questions

0-2 years experience

2-5 years experience

Follow-up Questions