Guard interface (canActivate) in NestJS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What does this guard do when canActivate returns false?

Consider a NestJS guard where the canActivate method returns false. What happens to the request?

NestJS

import { CanActivate, ExecutionContext } from '@nestjs/common';

export class SampleGuard implements CanActivate {
  canActivate(context: ExecutionContext): boolean {
    return false;
  }
}

A The request is blocked and a 403 Forbidden response is sent.

B The request proceeds to the route handler normally.

C The request causes a server error and crashes the app.

D The request is redirected to the login page automatically.

💡 Hint

Think about what returning false from a guard means in NestJS.

When canActivate returns false, NestJS blocks the request and sends a 403 Forbidden response automatically.

📝 Syntax

intermediate

Which option correctly implements canActivate to allow only requests with a header 'x-api-key' equal to 'secret'?

Choose the correct implementation of canActivate that checks if the request header x-api-key equals secret.

A

canActivate(context: ExecutionContext): boolean {
  const request = context.getRequest();
  return request.headers['x-api-key'] === 'secret';
}

B

canActivate(context: ExecutionContext): boolean {
  const request = context.switchToHttp().getRequest();
  return request.header('x-api-key') === 'secret';
}

C

canActivate(context: ExecutionContext): boolean {
  const request = context.switchToHttp().getRequest();
  return request.headers['x-api-key'] === 'secret';
}

D

canActivate(context: ExecutionContext): boolean {
  const request = context.switchToHttp().getRequest();
  return request.headers.xApiKey === 'secret';
}

💡 Hint

Use the correct method to get the HTTP request and access headers as an object.

The switchToHttp().getRequest() method returns the HTTP request object. Headers are accessed as request.headers['header-name']. Option C uses this correctly.

❓ state_output

advanced

What is the output when canActivate returns a Promise resolving to false?

If canActivate returns Promise.resolve(false), what does NestJS do with the request?

NestJS

import { CanActivate, ExecutionContext } from '@nestjs/common';

export class AsyncGuard implements CanActivate {
  canActivate(context: ExecutionContext): Promise<boolean> {
    return Promise.resolve(false);
  }
}

A The request is delayed indefinitely and times out.

B The request proceeds to the route handler normally.

C The request causes a runtime error because canActivate must return boolean synchronously.

D The request is blocked and a 403 Forbidden response is sent.

💡 Hint

NestJS supports async guards returning Promise.

NestJS supports asynchronous guards. If the Promise resolves to false, the request is blocked with a 403 Forbidden response.

🔧 Debug

advanced

Why does this guard always allow requests even when it should block some?

Identify the bug in this guard code that causes it to always allow requests.

NestJS

import { CanActivate, ExecutionContext } from '@nestjs/common';

export class BuggyGuard implements CanActivate {
  canActivate(context: ExecutionContext): boolean {
    const request = context.switchToHttp().getRequest();
    if (request.headers['authorization']) {
      true;
    }
    return true;
  }
}

A The if block does not return false when authorization header is missing, so it always returns true.

B The guard throws a syntax error because of missing return in the if block.

C The guard returns false always because the if block is ignored.

D The guard returns undefined causing a runtime error.

💡 Hint

Look carefully at the if block and what it returns.

The if block contains true; but does not return it. The function always returns true at the end, so it never blocks requests.

🧠 Conceptual

expert

Which statement about canActivate guards is true?

Select the true statement about the behavior of multiple guards applied to a single route in NestJS.

A All guards run in parallel and the request proceeds if any guard returns true.

B Guards run sequentially and the request proceeds only if all guards return true.

C Only the first guard runs and its result decides the request outcome.

D Guards run after the route handler executes to validate the response.

💡 Hint

Think about how multiple guards combine their results.

In NestJS, multiple guards run one after another. The request proceeds only if every guard returns true. If any guard returns false, the request is blocked.