Guard binding levels in NestJS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

Guard Binding Level: Controller vs Method

Consider a NestJS controller with a guard applied at both the controller and method levels. Which guard(s) will run when the method is called?

NestJS

import { Controller, Get, UseGuards } from '@nestjs/common';

@UseGuards(ControllerGuard)
@Controller('items')
export class ItemsController {
  @UseGuards(MethodGuard)
  @Get()
  findAll() {
    return 'items';
  }
}

A Only <code>ControllerGuard</code> runs before <code>findAll</code>.

B Both <code>ControllerGuard</code> and <code>MethodGuard</code> run, with <code>ControllerGuard</code> first.

C Only <code>MethodGuard</code> runs before <code>findAll</code>.

D Both <code>ControllerGuard</code> and <code>MethodGuard</code> run, with <code>MethodGuard</code> first.

💡 Hint

Think about how NestJS applies guards in a hierarchical order.

Guards applied at the controller level run before method-level guards. So both guards run, with the controller guard first, then the method guard.

❓ state_output

intermediate

Effect of Global Guard on Controller Guards

If a global guard denies access, what happens to guards applied at controller or method levels?

NestJS

import { Injectable, CanActivate, ExecutionContext, UseGuards, Controller, Get } from '@nestjs/common';

@Injectable()
class GlobalGuard implements CanActivate {
  canActivate(context: ExecutionContext) {
    return false; // always deny
  }
}

@UseGuards(GlobalGuard)
@Controller('users')
@UseGuards(ControllerGuard)
export class UsersController {
  @UseGuards(MethodGuard)
  @Get()
  findAll() {
    return 'users';
  }
}

A Only GlobalGuard runs and denies access; controller and method guards do not run.

B GlobalGuard runs and denies access; controller and method guards still run after.

C ControllerGuard runs first, then GlobalGuard denies access; method guard does not run.

D MethodGuard runs first, then GlobalGuard denies access; controller guard does not run.

💡 Hint

Global guards run before any other guards.

Global guards run first and can short-circuit the request. If a global guard denies access, no other guards run.

📝 Syntax

advanced

Correct Syntax for Applying Multiple Guards

Which option correctly applies two guards at the method level in NestJS?

NestJS

import { UseGuards } from '@nestjs/common';

class GuardOne {}
class GuardTwo {}

class SampleController {
  @UseGuards(/* ??? */)
  someMethod() {}
}

A @UseGuards('GuardOne', 'GuardTwo')

B @UseGuards([GuardOne, GuardTwo])

C @UseGuards({GuardOne, GuardTwo})

D @UseGuards(GuardOne, GuardTwo)

💡 Hint

Check the official NestJS syntax for multiple guards.

The @UseGuards decorator accepts multiple guard classes as separate arguments.

🔧 Debug

advanced

Why Does a Guard Not Run on a Route?

Given this code, why does AuthGuard not run when calling GET /profile?

NestJS

import { Controller, Get, UseGuards } from '@nestjs/common';

@Controller('profile')
export class ProfileController {
  @Get()
  @UseGuards(AuthGuard)
  getProfile() {
    return 'profile data';
  }
}

A The <code>@UseGuards</code> decorator must be applied at the controller level, not method level.

B The <code>@UseGuards</code> decorator is placed after <code>@Get()</code>, so it is ignored.

C The <code>AuthGuard</code> class is not imported or registered properly.

D The <code>getProfile</code> method is missing the <code>async</code> keyword.

💡 Hint

Check if the guard class is correctly imported and provided.

If the guard class is not imported or registered, NestJS silently skips running it. The decorator placement is correct, and async is not required.

🧠 Conceptual

expert

Order of Execution for Multiple Guards at Different Levels

In NestJS, if you have a global guard, a controller-level guard, and a method-level guard all applied, in what order do they execute?

A Global guard → Controller guard → Method guard

B Method guard → Controller guard → Global guard

C Controller guard → Global guard → Method guard

D Method guard → Global guard → Controller guard

💡 Hint

Think about the scope from broadest to narrowest.

Guards run from the broadest scope to the narrowest: global guards first, then controller guards, then method guards.