Guard binding levels in NestJS - Mini Project: Build & Apply

Guard Binding Levels in NestJS

📖 Scenario: You are building a NestJS application that needs to control access to routes using guards. Guards can be applied at different levels: method, controller, and global. Understanding how to bind guards at these levels helps you manage security effectively.

🎯 Goal: Build a NestJS app demonstrating guard binding at method, controller, and global levels. You will create a simple guard and apply it step-by-step to see how NestJS handles guard execution order.

📋 What You'll Learn

Create a simple guard class called AuthGuard that implements CanActivate.

Apply AuthGuard to a single route method.

Apply AuthGuard to a controller class.

Apply AuthGuard globally using app.useGlobalGuards().

💡 Why This Matters

🌍 Real World

Guards are used in real NestJS apps to protect routes based on authentication or roles. Knowing how to bind guards at different levels helps organize security cleanly.

💼 Career

Understanding guard binding levels is essential for backend developers working with NestJS to implement secure APIs and control access efficiently.

1

Create the AuthGuard class

Create a class called AuthGuard that implements CanActivate interface. Inside the canActivate method, return true to allow access.

NestJS

import { CanActivate, ExecutionContext } from '@nestjs/common';

// Your code here

Need a hint?

Use implements CanActivate and define canActivate method returning true.

2

Apply AuthGuard to a route method

In a controller class called AppController, create a method called getHello decorated with @Get(). Apply the AuthGuard to this method using @UseGuards(AuthGuard). The method should return the string 'Hello World'.

NestJS

import { CanActivate, ExecutionContext } from '@nestjs/common';

export class AuthGuard implements CanActivate {
  canActivate(context: ExecutionContext): boolean {
    return true;
  }
}

import { Controller, Get, UseGuards } from '@nestjs/common';

@Controller()
export class AppController {
  // Your code here
}

Need a hint?

Use @UseGuards(AuthGuard) above the getHello method.

3

Apply AuthGuard to the controller

Modify the AppController class to apply AuthGuard at the controller level by adding @UseGuards(AuthGuard) above the class declaration. Remove the guard from the getHello method.

NestJS

import { CanActivate, ExecutionContext } from '@nestjs/common';

export class AuthGuard implements CanActivate {
  canActivate(context: ExecutionContext): boolean {
    return true;
  }
}

import { Controller, Get, UseGuards } from '@nestjs/common';

// Your code here

Need a hint?

Place @UseGuards(AuthGuard) above @Controller() and remove it from the method.

4

Apply AuthGuard globally

In the main application bootstrap function, apply AuthGuard globally by calling app.useGlobalGuards(new AuthGuard()). Assume app is the NestJS application instance.

NestJS

import { CanActivate, ExecutionContext } from '@nestjs/common';

export class AuthGuard implements CanActivate {
  canActivate(context: ExecutionContext): boolean {
    return true;
  }
}

import { Controller, Get, UseGuards } from '@nestjs/common';

@UseGuards(AuthGuard)
@Controller()
export class AppController {
  @Get()
  getHello(): string {
    return 'Hello World';
  }
}

import { NestFactory } from '@nestjs/core';
import { AppModule } from './app.module';

async function bootstrap() {
  const app = await NestFactory.create(AppModule);
  // Add global guard here
  await app.listen(3000);
}

bootstrap();

Need a hint?

Call app.useGlobalGuards(new AuthGuard()) inside the bootstrap function before app.listen().