Combining multiple guards in NestJS - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to apply a single guard to a controller method.

NestJS

import { Controller, Get, [1] } from '@nestjs/common';

@Controller('cats')
export class CatsController {
  @Get()
  @[1](AuthGuard)
  findAll() {
    return 'This action returns all cats';
  }
}

Drag options to blanks, or click blank then click option'

AUseGuards

BInject

CSetMetadata

DController

Attempts:

3 left

💡 Hint

Common Mistakes

Using @Inject instead of @UseGuards

Trying to apply guards without a decorator

Confusing @Controller with guard decorators

The @UseGuards decorator is used to apply guards to controller methods or classes in NestJS.

2fill in blank

medium

Complete the code to apply multiple guards to a controller method.

NestJS

import { Controller, Get, UseGuards } from '@nestjs/common';
import { AuthGuard } from './auth.guard';
import { RolesGuard } from './roles.guard';

@Controller('dogs')
export class DogsController {
  @Get()
  @UseGuards([1])
  findAll() {
    return 'This action returns all dogs';
  }
}

Drag options to blanks, or click blank then click option'

AAuthGuard && RolesGuard

BAuthGuard, RolesGuard

C{AuthGuard, RolesGuard}

D[AuthGuard, RolesGuard]

Attempts:

3 left

💡 Hint

Common Mistakes

Passing guards separated by commas without brackets

Using object literal syntax instead of array

Using logical AND operator between guards

To apply multiple guards, you pass an array of guard classes to @UseGuards.

3fill in blank

hard

Fix the error in the code to correctly combine guards on a controller class.

NestJS

import { Controller, UseGuards } from '@nestjs/common';
import { AuthGuard } from './auth.guard';
import { RolesGuard } from './roles.guard';

@UseGuards([1])
@Controller('users')
export class UsersController {
  // methods here
}

Drag options to blanks, or click blank then click option'

AAuthGuard && RolesGuard

B[AuthGuard, RolesGuard]

C{AuthGuard, RolesGuard}

DAuthGuard, RolesGuard

Attempts:

3 left

💡 Hint

Common Mistakes

Passing guards without brackets

Using object literal syntax

Using logical operators instead of array

When applying multiple guards at the class level, you must pass them as an array to @UseGuards.

4fill in blank

hard

Fill both blanks to create a controller method guarded by AuthGuard and RolesGuard, and import the necessary decorators.

NestJS

import { Controller, Get, [1] } from '@nestjs/common';
import { AuthGuard } from './auth.guard';
import { RolesGuard } from './roles.guard';

@Controller('products')
export class ProductsController {
  @Get()
  @[2]([AuthGuard, RolesGuard])
  findAll() {
    return 'This action returns all products';
  }
}

Drag options to blanks, or click blank then click option'

AUseGuards

BSetMetadata

CInject

DController

Attempts:

3 left

💡 Hint

Common Mistakes

Importing the wrong decorator

Using different decorators for import and method

Not passing guards as an array

The UseGuards decorator must be imported and used to apply multiple guards to a method.

5fill in blank

hard

Fill all three blanks to define a controller class guarded by AuthGuard and RolesGuard, and import the necessary decorators.

NestJS

import { [1], [2] } from '@nestjs/common';
import { AuthGuard } from './auth.guard';
import { RolesGuard } from './roles.guard';

@[3]([AuthGuard, RolesGuard])
@Controller('orders')
export class OrdersController {
  // methods here
}

Drag options to blanks, or click blank then click option'

AUseGuards

BGet

CPost

DInject

EController

Attempts:

3 left

💡 Hint

Common Mistakes

Importing wrong decorators

Not applying @UseGuards on the class

Mixing method decorators with class decorators

You must import UseGuards and Controller decorators, then apply @UseGuards with the guards array on the class.

Practice

1.

What happens when you use @UseGuards(AuthGuard, RolesGuard) on a NestJS route handler?

Choose the best description.

easy

A. Only AuthGuard is checked; RolesGuard is ignored.

B. Both AuthGuard and RolesGuard must allow access for the request to proceed.

C. Either AuthGuard or RolesGuard allowing access is enough to proceed.

D. Guards run in parallel but only the first to approve grants access.

Solution

1. Step 1: Understand how multiple guards work in NestJS

   When multiple guards are used with @UseGuards(), NestJS runs them in sequence and requires all to approve access.

2. Step 2: Apply this to the given guards

   Both AuthGuard and RolesGuard must return true for the request to proceed.

3. Final Answer:

   Both AuthGuard and RolesGuard must allow access for the request to proceed. -> Option B

4. Quick Check:

   All guards must approve = A [OK]

Hint: All guards must pass for access, not just one [OK]

Common Mistakes:

• Thinking only one guard needs to pass
• Assuming guards run in parallel and race
• Believing guards are ignored if one fails

2.

Which of the following is the correct syntax to apply two guards AuthGuard and RolesGuard on a controller method?

?

easy

A. @UseGuards(AuthGuard && RolesGuard)
handleRequest() {}

B. @UseGuards(AuthGuard RolesGuard)
handleRequest() {}

C. @UseGuards(AuthGuard || RolesGuard)
handleRequest() {}

D. @UseGuards(AuthGuard, RolesGuard)
handleRequest() {}

Solution

1. Step 1: Recall the correct syntax for multiple guards

   In NestJS, multiple guards are passed as separate arguments to @UseGuards(), separated by commas.

2. Step 2: Check each option

   @UseGuards(AuthGuard, RolesGuard) handleRequest() {} correctly uses comma-separated guards. @UseGuards(AuthGuard RolesGuard) handleRequest() {} misses the comma between guards, causing a syntax error. Using && or || evaluates to only one guard.

3. Final Answer:

   @UseGuards(AuthGuard, RolesGuard) handleRequest() {} -> Option D

4. Quick Check:

   Comma-separated guards = C [OK]

Hint: Use commas to separate guards, avoid logical operators or missing commas in @UseGuards() [OK]

Common Mistakes:

• Omitting comma between guards
• Using && or || inside @UseGuards()
• Forgetting to separate guards by commas

3.

Given the following code snippet, what will be the output when a request is made?

@UseGuards(AuthGuard, RolesGuard)
@Get('profile')
getProfile() {
  return 'User Profile';
}

// AuthGuard returns true
// RolesGuard returns false

medium

A. Throws an UnauthorizedException

B. Returns 'User Profile'

C. Returns null

D. Returns an empty string

Solution

1. Step 1: Understand guard return values effect

   Guards must all return true to allow access. If any guard returns false, NestJS throws an UnauthorizedException by default.

2. Step 2: Apply given guard results

   Here, AuthGuard returns true but RolesGuard returns false, so access is denied and an exception is thrown.

3. Final Answer:

   Throws an UnauthorizedException -> Option A

4. Quick Check:

   Any guard false = UnauthorizedException [OK]

Hint: All guards must return true; one false blocks access [OK]

Common Mistakes:

• Assuming one guard false still allows access
• Expecting null or empty string instead of exception
• Confusing guard return values with response data

4.

Identify the error in this NestJS controller snippet using multiple guards:

@UseGuards(AuthGuard RolesGuard)
@Get('data')
getData() {
  return 'Data';
}

medium

A. The @Get decorator is misplaced

B. Guards must be passed as an array

C. Missing comma between guards in @UseGuards()

D. Guards cannot be combined on the same method

Solution

1. Step 1: Check syntax of @UseGuards()

   The guards inside @UseGuards() must be separated by commas.

2. Step 2: Identify the error in the snippet

   The snippet misses a comma between AuthGuard and RolesGuard, causing a syntax error.

3. Final Answer:

   Missing comma between guards in @UseGuards() -> Option C

4. Quick Check:

   Comma missing between guards = D [OK]

Hint: Check commas between guards inside @UseGuards() [OK]

Common Mistakes:

• Forgetting commas between guards
• Passing guards as an array incorrectly
• Misplacing decorators order

5.

You want to protect a route so that only authenticated users with the role 'admin' can access it. You have AuthGuard and RolesGuard available. How should you combine them in your controller method?

hard

A. @UseGuards(AuthGuard, RolesGuard) // RolesGuard checks for 'admin' role

B. @UseGuards(RolesGuard, AuthGuard) // Order does not matter

C. @UseGuards(AuthGuard || RolesGuard) // Either guard allows access

D. @UseGuards([RolesGuard, AuthGuard]) // Guards passed as array

Solution

1. Step 1: Understand guard order and combination

   Guards are combined by passing them comma-separated in @UseGuards(). Order matters: AuthGuard first authenticates and sets req.user, then RolesGuard checks the role.

2. Step 2: Choose correct syntax and logic

   @UseGuards(AuthGuard, RolesGuard) // RolesGuard checks for 'admin' role uses correct syntax, order, and notes the role check. Reversing to RolesGuard first fails as no user is set, and claims order irrelevant which is misleading. Array with reversed order fails similarly. Logical operators pass only one guard.

3. Final Answer:

   @UseGuards(AuthGuard, RolesGuard) // RolesGuard checks for 'admin' role -> Option A

4. Quick Check:

   Comma-separated guards with role check = B [OK]

Hint: Use comma-separated guards; RolesGuard checks roles [OK]

Common Mistakes:

• Using logical operators inside @UseGuards()
• Passing guards as an array
• Assuming guard order always matters