Protected routes with guards in NestJS - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to import the guard decorator in NestJS.

NestJS

import { [1] } from '@nestjs/common';

Drag options to blanks, or click blank then click option'

AUseGuards

BController

CInjectable

DModule

Attempts:

3 left

💡 Hint

Common Mistakes

Importing Controller instead of UseGuards

Using Injectable which is for services

Trying to import Module which is unrelated here

The UseGuards decorator is used to apply guards to routes in NestJS.

2fill in blank

medium

Complete the code to apply a guard to a route handler.

NestJS

@UseGuards([1])
@Get('profile')
getProfile() {
  return 'User profile';
}

Drag options to blanks, or click blank then click option'

AAuthGuard

BController

CInjectable

DModule

Attempts:

3 left

💡 Hint

Common Mistakes

Using Controller decorator instead of a guard

Using Injectable which is for services

Using Module which is unrelated here

The AuthGuard is a common guard used to protect routes by checking authentication.

3fill in blank

hard

Fix the error in the guard class by completing the method signature.

NestJS

canActivate([1]): boolean {
  // logic here
  return true;
}

Drag options to blanks, or click blank then click option'

Aresponse: Response

Bargs: any

Crequest: Request

Dcontext: ExecutionContext

Attempts:

3 left

💡 Hint

Common Mistakes

Using Request or Response directly as parameters

Using a generic 'args' parameter

Omitting the parameter

The canActivate method receives an ExecutionContext object in NestJS guards.

4fill in blank

hard

Fill both blanks to create a guard that checks if a user is authenticated.

NestJS

import { Injectable, CanActivate, [1] } from '@nestjs/common';

@Injectable()
export class AuthGuard implements CanActivate {
  canActivate([2]): boolean {
    const request = context.switchToHttp().getRequest();
    return !!request.user;
  }
}

Drag options to blanks, or click blank then click option'

AExecutionContext

BRequest

Ccontext: ExecutionContext

Dresponse: Response

Attempts:

3 left

💡 Hint

Common Mistakes

Using Request or Response instead of ExecutionContext

Omitting the parameter name or type

Importing wrong types

The guard imports ExecutionContext and the canActivate method receives context: ExecutionContext as parameter.

5fill in blank

hard

Fill all three blanks to apply the AuthGuard to a controller route.

NestJS

import { Controller, Get, [1] } from '@nestjs/common';

@Controller('users')
export class UserController {
  @[2]([3])
  @Get('dashboard')
  getDashboard() {
    return 'Dashboard data';
  }
}

Drag options to blanks, or click blank then click option'

AUseGuards

BAuthGuard

CUseGuards(AuthGuard)

DInjectable

Attempts:

3 left

💡 Hint

Common Mistakes

Trying to import or use AuthGuard as a decorator

Using Injectable instead of UseGuards

Putting UseGuards inside the decorator parentheses incorrectly

The UseGuards decorator is imported and used to apply the AuthGuard to the route.

Practice

1. What is the main purpose of a guard in NestJS when protecting routes?

easy

A. To decide if a request can access a route based on custom logic

B. To format the response data before sending it

C. To handle database connections automatically

D. To log every request made to the server

Solution

1. Step 1: Understand the role of guards

   Guards in NestJS are designed to control access to routes by running custom logic before the route handler executes.

2. Step 2: Identify the correct purpose

   Among the options, only deciding if a request can access a route matches the guard's role.

3. Final Answer:

   To decide if a request can access a route based on custom logic -> Option A

4. Quick Check:

   Guards control access = C [OK]

Hint: Guards allow or block access before route runs [OK]

Common Mistakes:

• Confusing guards with interceptors or middleware
• Thinking guards modify response data
• Assuming guards handle database tasks

2. Which of the following is the correct way to apply a guard to a route in NestJS?

easy

A. @UseGuards(AuthGuard) before the controller class

B. @UseGuards(AuthGuard) before the route handler method

C. @ApplyGuard(AuthGuard) inside the constructor

D. @Guard(AuthGuard) before the route handler

Solution

1. Step 1: Recall the decorator for guards

   The correct decorator to apply guards in NestJS is @UseGuards().

2. Step 2: Identify correct placement

   This decorator can be placed before a route handler method or a controller class. @UseGuards(AuthGuard) before the route handler method correctly shows it before a route handler method.

3. Final Answer:

   @UseGuards(AuthGuard) before the route handler method -> Option B

4. Quick Check:

   @UseGuards + route method = D [OK]

Hint: Use @UseGuards() decorator on methods or controllers [OK]

Common Mistakes:

• Using @Guard or @ApplyGuard which don't exist
• Placing decorators inside constructor
• Confusing middleware with guards

3. Given this guard implementation, what will happen when a request is made?

import { CanActivate, ExecutionContext } from '@nestjs/common';

export class AlwaysDenyGuard implements CanActivate {
  canActivate(context: ExecutionContext): boolean {
    return false;
  }
}

Applied to a route, what is the result?

medium

A. The guard throws an error causing a server crash

B. The route handler runs and returns its response

C. The request is blocked and the route handler does not run

D. The guard logs the request but allows it

Solution

1. Step 1: Analyze the canActivate method

   The guard's canActivate method always returns false, meaning it denies access.

2. Step 2: Understand guard effect on route

   When canActivate returns false, NestJS blocks the request and does not run the route handler.

3. Final Answer:

   The request is blocked and the route handler does not run -> Option C

4. Quick Check:

   canActivate false blocks request = A [OK]

Hint: canActivate false means block access [OK]

Common Mistakes:

• Thinking false lets the route run
• Assuming guard throws error on false
• Confusing logging with blocking

4. Identify the error in this guard code snippet:

import { CanActivate, ExecutionContext } from '@nestjs/common';

export class MyGuard implements CanActivate {
  canActivate(context: ExecutionContext) {
    if (context.switchToHttp().getRequest().user) {
      return true;
    }
  }
}

medium

A. Incorrect import of ExecutionContext

B. Using switchToHttp() is not allowed in guards

C. canActivate should be async but is not

D. Missing return statement when user is not present

Solution

1. Step 1: Check canActivate return paths

   The method returns true if user exists, but returns nothing (undefined) otherwise.

2. Step 2: Understand guard return requirements

   canActivate must always return a boolean or Promise<boolean>. Missing return means undefined, which is invalid.

3. Final Answer:

   Missing return statement when user is not present -> Option D

4. Quick Check:

   All paths must return boolean = B [OK]

Hint: Always return true or false in canActivate [OK]

Common Mistakes:

• Forgetting else return false
• Assuming undefined is false
• Thinking async is always required

5. You want to protect a route so only users with role 'admin' can access it. Which guard implementation correctly enforces this?

import { CanActivate, ExecutionContext } from '@nestjs/common';

export class RolesGuard implements CanActivate {
  canActivate(context: ExecutionContext): boolean {
    const request = context.switchToHttp().getRequest();
    const user = request.user;
    // Which condition correctly checks for admin role?
  }
}

hard

A. return user && user.role === 'admin';

B. return user && user.roles.includes('admin');

C. return user && user.roles === 'admin';

D. return user && user.role.includes('admin');

Solution

1. Step 1: Understand user role structure

   Assuming user has a single role string in property role, not an array.

2. Step 2: Check each condition

   return user && user.role === 'admin'; correctly compares user.role === 'admin'. return user && user.roles.includes('admin'); assumes roles is an array, which may be incorrect. Options C and D misuse property types.

3. Final Answer:

   return user && user.role === 'admin'; -> Option A

4. Quick Check:

   Check user.role string equals 'admin' = A [OK]

Hint: Match exact role property type to check admin [OK]

Common Mistakes:

• Confusing roles array with single role string
• Using includes on a string property
• Checking wrong property name