Why guards control access in NestJS - Challenge Your Understanding

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is the primary role of a guard in NestJS?

In NestJS, guards are used to control access to routes or controllers. What is the main purpose of a guard?

A To manage database connections for each request

B To transform the response data before sending it to the client

C To handle exceptions and send error responses

D To determine if a request should be allowed to proceed based on custom logic

💡 Hint

Think about what controls whether a user can enter a route or not.

Guards in NestJS decide if a request can continue to the route handler by returning true or false. They are mainly used for authorization and access control.

❓ component_behavior

intermediate

What happens when a guard returns false?

Consider a NestJS guard that returns false during a request. What is the effect on the request processing?

A The request is denied and a 403 Forbidden response is sent

B The request proceeds to the next middleware or handler

C The request is redirected to the login page automatically

D The server crashes with an error

💡 Hint

Think about what happens when access is denied.

If a guard returns false, NestJS stops processing the request and sends a 403 Forbidden response by default.

📝 Syntax

advanced

Identify the correct guard implementation syntax

Which of the following code snippets correctly implements a NestJS guard that allows access only if the user role is 'admin'?

NestJS

import { CanActivate, ExecutionContext, Injectable } from '@nestjs/common';

@Injectable()
export class AdminGuard implements CanActivate {
  canActivate(context: ExecutionContext): boolean {
    const request = context.switchToHttp().getRequest();
    const user = request.user;
    // Check user role
    return ???;
  }
}

A return user?.role === 'admin';

B return user.role = 'admin';

C return user.role == 'admin';

D return user.role === admin;

💡 Hint

Use strict equality and optional chaining to avoid errors if user is undefined.

Option A uses optional chaining to safely access user.role and strict equality to compare with 'admin'.

Option A uses assignment (=) instead of comparison (===), which is wrong.

Option A uses loose equality (==), which is less safe.

Option A misses quotes around 'admin', causing a ReferenceError.

❓ state_output

advanced

What is the output when a guard throws an exception?

Given this guard code snippet, what will be the HTTP response status code if the guard throws a ForbiddenException? import { CanActivate, ExecutionContext, Injectable, ForbiddenException } from '@nestjs/common'; @Injectable() export class SampleGuard implements CanActivate { canActivate(context: ExecutionContext): boolean { throw new ForbiddenException('Access denied'); } }

A 500 Internal Server Error

B 401 Unauthorized with message 'Access denied'

C 403 Forbidden with message 'Access denied'

D 200 OK with empty response

💡 Hint

ForbiddenException corresponds to which HTTP status code?

Throwing ForbiddenException causes NestJS to send a 403 Forbidden response with the provided message.

🔧 Debug

expert

Why does this guard block even admin access?

Review the following guard code. Why does it fail to allow access for users with the 'admin' role? import { CanActivate, ExecutionContext, Injectable } from '@nestjs/common'; @Injectable() export class FaultyGuard implements CanActivate { canActivate(context: ExecutionContext): boolean { const request = context.switchToHttp().getRequest(); const user = request.user; if (user.role === 'admin') { true; } return false; } }

A The user object is undefined, causing a runtime error

B The guard always returns false because the if block does not return true explicitly

C The guard returns true for all users because of missing else statement

D The guard throws an exception instead of returning a boolean

💡 Hint

Check if the if block returns a value properly.

The if block contains 'true;' but does not return it. So the function always returns false, blocking all access.