Combining multiple guards in NestJS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when multiple guards are applied to a NestJS route?

Consider a NestJS controller method protected by two guards: AuthGuard and RolesGuard. What is the behavior when both guards are applied?

NestJS

import { Controller, Get, UseGuards } from '@nestjs/common';
import { AuthGuard } from './auth.guard';
import { RolesGuard } from './roles.guard';

@Controller('items')
export class ItemsController {
  @Get()
  @UseGuards(AuthGuard, RolesGuard)
  findAll() {
    return 'Items list';
  }
}

A Both guards run in parallel; the request is allowed if either guard returns true.

B Both guards run in the order declared; if any guard returns false, the request is denied.

C Only the first guard runs; the second guard is ignored.

D Guards run randomly; the request is allowed only if the last guard returns true.

💡 Hint

Think about how NestJS processes multiple guards in sequence.

In NestJS, multiple guards applied to a route run one after another in the order they are declared. If any guard denies access by returning false, the request is denied immediately.

📝 Syntax

intermediate

Which code correctly applies multiple guards to a NestJS route?

Choose the correct syntax to apply AuthGuard and RolesGuard to a controller method.

A

@UseGuards(AuthGuard || RolesGuard)
getData() { return 'data'; }

B

@UseGuards([AuthGuard, RolesGuard])
getData() { return 'data'; }

C

@UseGuards(AuthGuard && RolesGuard)
getData() { return 'data'; }

D

@UseGuards(AuthGuard, RolesGuard)
getData() { return 'data'; }

💡 Hint

Remember the decorator syntax for multiple guards.

The @UseGuards decorator accepts multiple guard classes either as separate arguments or as an array, not as logical expressions. Logical expressions like || or && evaluate to a single class.

❓ state_output

advanced

What is the output when the first guard denies access?

Given two guards AuthGuard and RolesGuard applied to a route, if AuthGuard returns false, what happens?

NestJS

import { CanActivate, ExecutionContext } from '@nestjs/common';

class AuthGuard implements CanActivate {
  canActivate(context: ExecutionContext): boolean {
    return false; // denies access
  }
}

class RolesGuard implements CanActivate {
  canActivate(context: ExecutionContext): boolean {
    console.log('RolesGuard checked');
    return true;
  }
}

// Route uses @UseGuards(AuthGuard, RolesGuard)

A Request is denied immediately; RolesGuard is not executed.

B Request is allowed because RolesGuard returns true.

C Request is denied after both guards run.

D Request causes a runtime error because of conflicting guards.

💡 Hint

Consider the guard execution order and short-circuit behavior.

Guards run in order and stop at the first guard that returns false, denying the request immediately without running subsequent guards.

🔧 Debug

advanced

Why does this combined guard setup apply only one guard?

Examine the following code snippet. Why does it apply only RolesGuard instead of both?

NestJS

import { UseGuards } from '@nestjs/common';

@UseGuards(AuthGuard && RolesGuard)
getData() {
  return 'data';
}

A Using logical AND (&&) between guard classes evaluates to the last truthy class instead of both.

B Guards must be instantiated before use; classes alone cause errors.

C Missing parentheses around guards causes a syntax error.

D The guards are applied correctly; error is unrelated.

💡 Hint

Check how decorators expect arguments.

The @UseGuards decorator expects guard classes as separate arguments or an array. Using AuthGuard && RolesGuard evaluates to RolesGuard (both classes truthy), applying only one guard.

🧠 Conceptual

expert

How does NestJS handle asynchronous guards when combined?

When multiple guards return Promise<boolean> (are async), how does NestJS process them?

A NestJS does not support async guards; it throws an error.

B NestJS runs all guards in parallel and allows access if any resolves to true.

C NestJS awaits each guard in order; if any resolves to false, it stops and denies access.

D NestJS runs guards sequentially but ignores their resolved values.

💡 Hint

Think about how async functions and promises work in sequence.

NestJS supports async guards by awaiting each guard's canActivate method in order. If any guard resolves to false, the request is denied immediately without running further guards.