Protected routes with guards in NestJS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when a request is made to a route protected by a guard that returns false?

Consider a NestJS route protected by a guard. The guard's canActivate method returns false. What will be the result when a client tries to access this route?

NestJS

import { Injectable, CanActivate, ExecutionContext } from '@nestjs/common';

@Injectable()
export class AuthGuard implements CanActivate {
  canActivate(context: ExecutionContext): boolean {
    return false;
  }
}

// Controller snippet
@Get('protected')
@UseGuards(AuthGuard)
getProtected() {
  return 'Protected content';
}

A The request is denied and the client receives a 403 Forbidden response.

B The request proceeds and the client receives 'Protected content'.

C The server throws an internal server error (500).

D The guard is ignored and the route behaves as if unprotected.

💡 Hint

Think about what returning false from canActivate means for route access.

When a guard's canActivate method returns false, NestJS denies access to the route and responds with a 403 Forbidden status. This prevents the route handler from executing.

📝 Syntax

intermediate

Which option correctly implements a guard that allows access only if a request header 'x-api-key' equals 'secret'?

Choose the correct NestJS guard implementation that checks if the request header x-api-key equals secret. If it matches, access is allowed; otherwise, denied.

A

import { Injectable, CanActivate, ExecutionContext } from '@nestjs/common';

@Injectable()
export class ApiKeyGuard implements CanActivate {
  canActivate(context: ExecutionContext): boolean {
    const request = context.switchToHttp().getRequest();
    return request.headers.xApiKey === 'secret';
  }
}

B

import { Injectable, CanActivate, ExecutionContext } from '@nestjs/common';

@Injectable()
export class ApiKeyGuard implements CanActivate {
  canActivate(context: ExecutionContext) {
    const request = context.switchToHttp().getRequest();
    if (request.headers['x-api-key'] === 'secret') {
      return true;
    }
    return false;
  }
}

C

import { Injectable, CanActivate, ExecutionContext } from '@nestjs/common';

@Injectable()
export class ApiKeyGuard implements CanActivate {
  canActivate(context: ExecutionContext): boolean {
    const request = context.switchToHttp().getRequest();
    return request.headers['X-API-KEY'] === 'secret';
  }
}

D

import { Injectable, CanActivate, ExecutionContext } from '@nestjs/common';

@Injectable()
export class ApiKeyGuard implements CanActivate {
  canActivate(context: ExecutionContext): boolean {
    const request = context.switchToHttp().getRequest();
    return request.headers['x-api-key'] === 'secret';
  }
}

💡 Hint

Remember that HTTP headers are case-insensitive but usually accessed in lowercase in Node.js.

Option D correctly accesses the header in lowercase and compares it to 'secret'. Option D uses assignment instead of comparison. Option D uses camelCase which is incorrect for headers. Option D uses uppercase keys which may not match the actual header key in Node.js.

🔧 Debug

advanced

Why does this guard always allow access even when the token is missing?

Examine the following guard code. It is intended to deny access if the authorization header is missing. However, it always allows access. What is the cause?

NestJS

import { Injectable, CanActivate, ExecutionContext } from '@nestjs/common';

@Injectable()
export class TokenGuard implements CanActivate {
  canActivate(context: ExecutionContext): boolean {
    const request = context.switchToHttp().getRequest();
    if (!request.headers.authorization) {
      return false;
    }
    return true;
  }
}

A The guard throws a syntax error due to missing return in the if block.

B The guard returns undefined causing NestJS to allow access by default.

C The guard always returns true because the if block does not return false explicitly.

D The guard returns false but the route is still accessible due to misconfiguration.

💡 Hint

Look carefully at the if block and what it returns.

The if block contains true; but does not return it. The function always returns true at the end, so access is always allowed.

❓ state_output

advanced

What is the output when a guard throws an exception inside canActivate?

Consider a guard that throws a ForbiddenException inside its canActivate method. What will the client receive when accessing the protected route?

NestJS

import { Injectable, CanActivate, ExecutionContext, ForbiddenException } from '@nestjs/common';

@Injectable()
export class ExceptionGuard implements CanActivate {
  canActivate(context: ExecutionContext): boolean {
    throw new ForbiddenException('Access denied');
  }
}

// Controller snippet
@Get('secret')
@UseGuards(ExceptionGuard)
getSecret() {
  return 'Secret data';
}

A The client receives a 403 Forbidden response with message 'Access denied'.

B The client receives a 500 Internal Server Error response.

C The client receives 'Secret data' because exceptions are ignored.

D The server crashes and stops responding.

💡 Hint

Think about how NestJS handles exceptions thrown in guards.

When a guard throws a ForbiddenException, NestJS catches it and sends a 403 Forbidden response with the provided message.

🧠 Conceptual

expert

Which statement about NestJS guards and route protection is TRUE?

Choose the correct statement about how NestJS guards protect routes.

A Guards run after route handlers and can modify the response before sending.

B Multiple guards can be applied to a route and all must return true to allow access.

C Guards can only be applied at the controller level, not on individual routes.

D If a guard returns a Promise that resolves to false, NestJS treats it as true.

💡 Hint

Consider how multiple guards work together in NestJS.

In NestJS, multiple guards can be applied to a route. All guards must return true (or resolve to true) for access to be granted. Guards run before the route handler. Guards can be applied at both controller and route levels. If a guard returns a Promise resolving to false, access is denied.