Protected routes with guards in NestJS - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of a guard in NestJS?

A guard in NestJS controls access to routes by deciding if a request should proceed based on conditions like authentication or roles.

beginner

How do you apply a guard to protect a route in NestJS?

You apply a guard by using the @UseGuards() decorator on a controller or route handler to check conditions before allowing access.

intermediate

What method must a NestJS guard implement?

A NestJS guard must implement the canActivate() method, which returns true or false (or a Promise/Observable of these) to allow or deny access.

intermediate

How can you access the current request inside a guard?

Inside canActivate(), you can access the request object via the ExecutionContext parameter using context.switchToHttp().getRequest().

beginner

What happens if a guard returns false in canActivate()?

If canActivate() returns false, NestJS denies the request and responds with a 403 Forbidden error by default.

Which decorator is used to apply a guard to a route in NestJS?

A @UseGuards()

B @Guard()

C @Protect()

D @Auth()

The @UseGuards() decorator is the correct way to apply guards to routes or controllers.

What does the canActivate() method in a guard return to allow access?

A null

B false

C true

D undefined

Returning true from canActivate() means the request is allowed to proceed.

Where do you get the HTTP request object inside a guard?

A context.getRequest()

B context.switchToHttp().getRequest()

C context.request

D context.httpRequest()

The correct way is context.switchToHttp().getRequest() to access the request in HTTP context.

What HTTP status code is returned if a guard denies access?

A 403 Forbidden

B 401 Unauthorized

C 404 Not Found

D 500 Internal Server Error

By default, NestJS returns 403 Forbidden when a guard returns false.

Can guards in NestJS be asynchronous?

A Only if using middleware

B No, canActivate() must be synchronous

C Only if using callbacks

D Yes, canActivate() can return a Promise or Observable

Guards can be async by returning a Promise or Observable from canActivate().

Explain how to create and use a guard to protect a route in NestJS.

Think about how NestJS checks access before running route handlers.

Describe what happens when a guard denies access to a route in NestJS.

Focus on the flow after canActivate returns false.