Guard interface (canActivate) in NestJS - Step-by-Step Execution

Concept Flow - Guard interface (canActivate)

Request comes in

↓

Guard's canActivate called

↓

Check condition inside canActivate

↓

Allow

↓

Route

When a request arrives, NestJS calls the guard's canActivate method. If it returns true, the request proceeds. If false, access is blocked.

Execution Sample

NestJS

import { CanActivate, ExecutionContext } from '@nestjs/common';

export class AuthGuard implements CanActivate {
  canActivate(context: ExecutionContext): boolean {
    const request = context.switchToHttp().getRequest();
    return !!request.user;
  }
}

This guard checks if the request has a user object. If yes, it allows access; otherwise, it blocks.

Execution Table

Step	Action	Evaluation	Result
1	Request arrives	N/A	Trigger canActivate
2	Extract request from context	request object obtained	request.user exists?
3	Check if request.user is truthy	request.user = undefined	false
4	Return false from canActivate	Access denied	Route handler NOT called
5	Request arrives	N/A	Trigger canActivate
6	Extract request from context	request object obtained	request.user exists?
7	Check if request.user is truthy	request.user = {id:1}	true
8	Return true from canActivate	Access granted	Route handler called

💡 Execution stops after canActivate returns true or false, deciding access.

Variable Tracker

Variable	Start	After Step 2	After Step 3	After Step 7	Final
request	undefined	{ user: undefined }	{ user: undefined }	{ user: { id: 1 } }	{ user: { id: 1 } }
canActivate result	undefined	undefined	false	undefined	true

Key Moments - 3 Insights

Why does canActivate sometimes return false even if the request exists?

Because canActivate checks a condition inside the request, like if request.user exists. The request object always exists, but the user property might be missing, causing false (see execution_table rows 2-4).

What happens if canActivate returns false?

The route handler is NOT called and access is blocked. This is shown in execution_table row 4 where the result is 'Route handler NOT called'.

Can canActivate return a Promise or Observable?

Yes, but in this example it returns a boolean directly. NestJS supports async guards that return Promise<boolean> or Observable<boolean>.

Visual Quiz - 3 Questions

Look at the execution table, what is the canActivate result at step 4?

A true

B false

C undefined

D throws error

💡 Hint

Check the 'Result' column at step 4 in the execution_table.

At which step does the guard allow the route handler to be called?

A Step 4

B Step 3

C Step 8

D Step 2

💡 Hint

Look for 'Route handler called' in the 'Result' column of execution_table.

If request.user is missing, what will canActivate return?

A false

B throws error

C true

D undefined

💡 Hint

See variable_tracker and execution_table rows where request.user is undefined.

Concept Snapshot

Guard interface (canActivate):
- Guards check if a request can proceed.
- canActivate(context) returns true (allow) or false (block).
- Access granted if true, else blocked.
- Can be synchronous or async.
- Used to protect routes in NestJS.

Full Transcript

In NestJS, a Guard is a special class that decides if a request can continue to a route. The key method is canActivate, which receives the request context. Inside canActivate, you check conditions like if the user is logged in. If the check passes, return true to allow access. If not, return false to block. The execution flow starts when a request arrives, NestJS calls canActivate, and based on its boolean result, the route handler runs or not. This example shows canActivate checking if request.user exists. If yes, access is allowed; if no, access is denied. Guards can also return promises or observables for async checks. Understanding this flow helps protect routes easily.