Guard binding levels in NestJS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

Guard Binding Level: Controller vs Method

Consider a NestJS controller with a guard applied at both the controller and method levels. Which guard(s) will run when the method is called?

NestJS

import { Controller, Get, UseGuards } from '@nestjs/common';

@UseGuards(ControllerGuard)
@Controller('items')
export class ItemsController {
  @UseGuards(MethodGuard)
  @Get()
  findAll() {
    return 'items';
  }
}

A Only <code>ControllerGuard</code> runs before <code>findAll</code>.

B Both <code>ControllerGuard</code> and <code>MethodGuard</code> run, with <code>ControllerGuard</code> first.

C Only <code>MethodGuard</code> runs before <code>findAll</code>.

D Both <code>ControllerGuard</code> and <code>MethodGuard</code> run, with <code>MethodGuard</code> first.

💡 Hint

Think about how NestJS applies guards in a hierarchical order.

Guards applied at the controller level run before method-level guards. So both guards run, with the controller guard first, then the method guard.

❓ state_output

intermediate

Effect of Global Guard on Controller Guards

If a global guard denies access, what happens to guards applied at controller or method levels?

NestJS

import { Injectable, CanActivate, ExecutionContext, UseGuards, Controller, Get } from '@nestjs/common';

@Injectable()
class GlobalGuard implements CanActivate {
  canActivate(context: ExecutionContext) {
    return false; // always deny
  }
}

@UseGuards(GlobalGuard)
@Controller('users')
@UseGuards(ControllerGuard)
export class UsersController {
  @UseGuards(MethodGuard)
  @Get()
  findAll() {
    return 'users';
  }
}

A Only GlobalGuard runs and denies access; controller and method guards do not run.

B GlobalGuard runs and denies access; controller and method guards still run after.

C ControllerGuard runs first, then GlobalGuard denies access; method guard does not run.

D MethodGuard runs first, then GlobalGuard denies access; controller guard does not run.

💡 Hint

Global guards run before any other guards.

Global guards run first and can short-circuit the request. If a global guard denies access, no other guards run.

📝 Syntax

advanced

Correct Syntax for Applying Multiple Guards

Which option correctly applies two guards at the method level in NestJS?

NestJS

import { UseGuards } from '@nestjs/common';

class GuardOne {}
class GuardTwo {}

class SampleController {
  @UseGuards(/* ??? */)
  someMethod() {}
}

A @UseGuards('GuardOne', 'GuardTwo')

B @UseGuards([GuardOne, GuardTwo])

C @UseGuards({GuardOne, GuardTwo})

D @UseGuards(GuardOne, GuardTwo)

💡 Hint

Check the official NestJS syntax for multiple guards.

The @UseGuards decorator accepts multiple guard classes as separate arguments.

🔧 Debug

advanced

Why Does a Guard Not Run on a Route?

Given this code, why does AuthGuard not run when calling GET /profile?

NestJS

import { Controller, Get, UseGuards } from '@nestjs/common';

@Controller('profile')
export class ProfileController {
  @Get()
  @UseGuards(AuthGuard)
  getProfile() {
    return 'profile data';
  }
}

A The <code>@UseGuards</code> decorator must be applied at the controller level, not method level.

B The <code>@UseGuards</code> decorator is placed after <code>@Get()</code>, so it is ignored.

C The <code>AuthGuard</code> class is not imported or registered properly.

D The <code>getProfile</code> method is missing the <code>async</code> keyword.

💡 Hint

Check if the guard class is correctly imported and provided.

If the guard class is not imported or registered, NestJS silently skips running it. The decorator placement is correct, and async is not required.

🧠 Conceptual

expert

Order of Execution for Multiple Guards at Different Levels

In NestJS, if you have a global guard, a controller-level guard, and a method-level guard all applied, in what order do they execute?

A Global guard → Controller guard → Method guard

B Method guard → Controller guard → Global guard

C Controller guard → Global guard → Method guard

D Method guard → Global guard → Controller guard

💡 Hint

Think about the scope from broadest to narrowest.

Guards run from the broadest scope to the narrowest: global guards first, then controller guards, then method guards.

Practice

1. Which of the following is true about guard binding levels in NestJS?

easy

A. Route guards apply to all controllers automatically.

B. Global guards apply to all routes in the application.

C. Controller guards cannot be overridden by route guards.

D. Guards can only be applied globally, not to specific routes.

Solution

1. Step 1: Understand global guard scope

   Global guards are set once and protect every request in the app.

2. Step 2: Compare with other guard levels

   Route guards apply only to specific routes, and controller guards apply to all routes in a controller. Route guards can override controller guards.

3. Final Answer:

   Global guards apply to all routes in the application. -> Option B

4. Quick Check:

   Global guard = all routes [OK]

Hint: Global guards protect all routes, no exceptions [OK]

Common Mistakes:

• Thinking route guards apply globally
• Believing controller guards cannot be overridden
• Assuming guards can't be applied to routes

2. Which is the correct way to bind a guard to a specific route in NestJS?

easy

A. Use @GlobalGuard decorator on the route

B. @UseGuards(MyGuard) above the controller class

C. Add MyGuard to the global providers array

D. @UseGuards(MyGuard) above the route handler method

Solution

1. Step 1: Identify route-level guard binding

   To bind a guard to a specific route, place @UseGuards() decorator above the route handler method.

2. Step 2: Differentiate from other bindings

   @UseGuards() above the controller binds to all routes in that controller. Global guards are set differently, and @GlobalGuard does not exist.

3. Final Answer:

   @UseGuards(MyGuard) above the route handler method -> Option D

4. Quick Check:

   Route guard = @UseGuards on method [OK]

Hint: Use @UseGuards on method for route-level guards [OK]

Common Mistakes:

• Putting @UseGuards only on controller for route guard
• Confusing global providers with route guards
• Using non-existent @GlobalGuard decorator

3. Given this code snippet, what will happen when a request hits the GET /users/profile route?

@UseGuards(GlobalGuard)
@Controller('users')
@UseGuards(ControllerGuard)
export class UserController {
  @Get('profile')
  @UseGuards(RouteGuard)
  getProfile() {
    return 'User Profile';
  }
}

medium

A. GlobalGuard, ControllerGuard, and RouteGuard all run in order.

B. Only GlobalGuard runs before the route handler.

C. Only RouteGuard runs, ignoring others.

D. ControllerGuard overrides and disables other guards.

Solution

1. Step 1: Identify guard binding levels in code

   GlobalGuard is bound globally, ControllerGuard on the controller, and RouteGuard on the route method.

2. Step 2: Understand guard execution order

   All guards bound at different levels run in order: global first, then controller, then route.

3. Final Answer:

   GlobalGuard, ControllerGuard, and RouteGuard all run in order. -> Option A

4. Quick Check:

   All guards run in binding order [OK]

Hint: All guards at different levels run in sequence [OK]

Common Mistakes:

• Assuming only one guard runs
• Thinking controller guard disables others
• Believing global guard runs alone

4. You have a guard bound globally and another bound to a controller. The controller guard is not running on requests. What is the likely cause?

medium

A. The controller guard was not added to the controller with @UseGuards.

B. Controller guards cannot be used with global guards.

C. Guards must be bound only at one level, not multiple.

D. The global guard is blocking all requests before the controller guard runs.

Solution

1. Step 1: Check guard binding syntax

   Controller guards must be explicitly added with @UseGuards on the controller class.

2. Step 2: Understand guard coexistence

   Global and controller guards can coexist; global guards do not block controller guards from running.

3. Final Answer:

   The controller guard was not added to the controller with @UseGuards. -> Option A

4. Quick Check:

   Missing @UseGuards on controller = no controller guard [OK]

Hint: Always add @UseGuards to controller for controller guards [OK]

Common Mistakes:

• Thinking global guard blocks controller guards
• Believing guards can't be combined
• Forgetting to decorate controller with @UseGuards

5. You want to apply a guard that blocks access to all routes except one specific route in a controller. Which approach correctly uses guard binding levels to achieve this?

hard

A. Bind the guard globally and use a route-level guard to allow the exception route.

B. Bind the guard only on the exception route to block all others.

C. Bind the guard on the controller and override it with a route-level guard that allows the exception.

D. Bind the guard globally and remove it from the exception route using @SkipGuards.

Solution

1. Step 1: Understand guard override behavior

   Controller-level guards apply to all routes in that controller but can be overridden by route-level guards.

2. Step 2: Apply guard to block all except one route

   Binding the guard on the controller blocks all routes; then a route-level guard on the exception route can allow access.

3. Final Answer:

   Bind the guard on the controller and override it with a route-level guard that allows the exception. -> Option C

4. Quick Check:

   Controller guard + route override = selective access [OK]

Hint: Use controller guard plus route guard override for exceptions [OK]

Common Mistakes:

• Trying to remove global guards per route (not supported)
• Binding guard only on exception route (wrong logic)
• Assuming global guard can be skipped per route